npm-trusted-publishing

OIDC-based npm publishing replaces long-lived NPM_TOKEN secrets with short-lived tokens from GitHub Actions, eliminating token leak risks. Configure GitHub Actions with id-token: write permissions, set up trusted publishers in npmjs.com, and use npm publish --provenance to authenticate securely without storing credentials.

Provenance attestations are cryptographic records proving a package's origin and build process. They document which GitHub Actions workflow published the package, creating an auditable chain of custody that helps consumers verify package authenticity and detect tampering.

Yes. Configure each package's package.json with the correct repository.url matching your GitHub repository, set the directory field for non-root packages, and configure per-package trusted-publisher settings in npmjs.com. Each monorepo package publishes independently with its own OIDC token.

Set id-token: write permissions in your GitHub Actions workflow to request OIDC tokens. Ensure package.json repository.url exactly matches your GitHub repository URL, update npm version before publishing, and use npm publish --access public --provenance to enable both access and provenance.

Long-lived NPM_TOKEN secrets pose security risks if exposed in logs, forks, or compromised workflows. Trusted publishing uses ephemeral GitHub Actions tokens valid only for that workflow run, automatically rotating credentials and reducing the blast radius of any token compromise.

Yes, npm trusted publishing is designed specifically for GitHub Actions. It uses GitHub's OIDC provider to issue workflow-scoped tokens, eliminating the need to store npm credentials as repository secrets while maintaining full CI/CD automation.