npm-publish

Automate npm package publishing with pre-flight checks and provenance.

Updated Apr 10, 2026
One-click install
npx skills add https://github.com/theslashdojo/dojo --skill npm-publish-theslashdojo
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: npm-publish
Source: https://github.com/theslashdojo/dojo/tree/main/nodes/node/npm/publish
Command: npx skills add https://github.com/theslashdojo/dojo --skill npm-publish-theslashdojo

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This skill automates publishing npm packages to the registry, handling version bumps, access controls, and safety checks to prevent accidental releases.

Core Features & Use Cases

  • Automates login validation, tarball preview with npm pack --dry-run, and version bumps using npm version.
  • Enforces prepublishOnly workflow, supports scoped packages with proper access, and enables provenance for supply chain security.
  • Use Case: Release a new package version to npm with automatic checks and optional provenance in CI.

Quick Start

Run the publish-package.sh script in your package directory to perform a safe publish to npm.

Frequently Asked Questions about npm-publish

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I publish an npm package safely with automated pre-flight checks?

To publish an npm package safely, you need automated pre-flight checks that validate login status, ensure unique versions, and run prepublishOnly hooks before executing the registry release.

How does npm provenance work for supply chain security in CI?

Npm provenance enhances supply chain security by generating verifiable publishing state during CI releases, ensuring the published package artifacts are cryptographically linked to their source repository.

What's the best way to automate version bumps for scoped npm packages?

The best way to automate version bumps for scoped npm packages is using npm version combined with access controls, ensuring proper visibility settings before running prepublish checks.

Can I preview the tarball contents before publishing to the npm registry?

Yes, you can preview tarball contents before publishing to the npm registry by running npm pack --dry-run, which validates the exact files included in your package release.

Why does my npm publish workflow fail without prepublishOnly hooks?

Your npm publish workflow fails without prepublishOnly hooks because safe release workflows enforce this pre-flight validation step to prevent accidental releases of untested or improperly versioned packages.