skills.rest
ZHLX2005
ZHLX2005COMMUNITY
Explore all skills by this author →
GitHub

npm-work-flow

Configures a GitHub Actions workflow that publishes npm packages on push to main.

3|1|Updated Apr 14, 2026
Search Tags:#automation#ci/cd#npm#github actions#release#provenance#publish
One-click install
npx skills add https://github.com/ZHLX2005/sl --skill npm-work-flow-zhlx2005
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: npm-work-flow
Source: https://github.com/ZHLX2005/sl/tree/main/skills/npm-work-flow
Command: npx skills add https://github.com/ZHLX2005/sl --skill npm-work-flow-zhlx2005

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Manually running npm version and npm publish for every release is repetitive and error-prone. This Skill provides a reusable GitHub Actions template that automates npm publishing whenever code is pushed to the main branch, with built-in idempotency checks so re-runs are safe. ## Core Features & Use Cases - Standard publish workflow template: A complete .github/workflows/npm-publish.yml covering version detection, git tag creation, npm registry checks, and npm publish --provenance. - Idempotency by design: Two-layer checks (git tag existence and npm registry version lookup) prevent duplicate tags and failed re-publishes. - Prerequisites and verification checklists: Covers NPM_TOKEN (Automation type) setup, package.json repository field requirements, actionlint validation, and post-publish verification on npmjs.com. - Use Case: You maintain a TypeScript CLI package and want every merge to main to automatically tag the release and publish it to npmjs with a Sigstore provenance badge, without touching the terminal. ## Quick Start Ask the AI to set up the npm publish GitHub Actions workflow for my package using this skill's template.

Frequently Asked Questions about npm-work-flow

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I automatically publish an npm package with GitHub Actions?▼

Create a workflow triggered on push to main that reads the version from package.json, creates a git tag if missing, checks whether the version exists on npm, and runs npm publish --provenance with NODE_AUTH_TOKEN set from an NPM_TOKEN secret.

What npm token type should I use for CI publishing?▼

Use an Automation token, not a Publish token. Automation tokens do not expire and bypass 2FA, while Publish tokens expire after 90 days and fail when two-factor authentication is enabled.

Why does npm publish --provenance fail in GitHub Actions?▼

Provenance fails when package.json lacks the repository.url field or when the repository is private without extra OIDC configuration. Add the repository field pointing to your GitHub repo, or drop the --provenance flag for private repositories.

Why does the git tag check fail in my publish workflow?▼

Tag detection fails when actions/checkout runs without fetch-depth: 0, because the shallow clone lacks tag history. Set fetch-depth to 0 so git rev-parse can find existing tags.

Can I use this workflow with a private npm registry or monorepo?▼

For private registries like Verdaccio, change registry-url in setup-node and adjust the token secret. Monorepos need paths filters and per-package workflows, which this single-package template does not cover.

Related Skills

Explore More Software Engineering Skills→
pr-pmpr-pm
121

npm-trusted-publishing

Configure GitHub Actions OIDC trusted publishing for npm packages.

Community
Intermediate
dwmkerrdwmkerr
23

release-please-development

Automates version bumps, changelog generation, and GitHub releases via Release Please.

Community
Intermediate
bseleebselee

deploy

Automate Node.js production deployment with Git merge and PR creation.

Community
Advanced
pwarnockpwarnock
2

release-publishing

Automate release planning and publishing workflows with Changesets and semantic versioning.

Community
Intermediate