publish-npm-package

Automate npm package publishing via GitHub Actions by configuring workflow files to run release commands upon merging to main, removing manual npm login and publish commands. This skill supports semantic-release, changesets, and release-please for reliable, repeatable releases.

OIDC trusted publishing for npm packages is a secure authentication method that enables zero-secrets automated releases via GitHub Actions. It eliminates the need for long-lived access tokens by establishing a trust relationship between your GitHub workflow and npm registry.

Provenance attestation for npm releases works by generating cryptographic attestations during the GitHub Actions publishing process. It enforces supply-chain security by proving the package origin and build integrity, ensuring reliable and secure releases.

Yes, you can use semantic-release with GitHub Actions to publish npm packages. This skill supports flexible versioning strategies including semantic-release, changesets, and release-please, allowing for automated or human-gated versioning for open-source libraries.

You do not necessarily need granular access tokens to publish npm packages in CI/CD. This skill supports OIDC trusted publishing for zero-secrets authentication, but also integrates granular access tokens if your specific npm access settings require them.

Reliable npm publishing workflows require careful configuration of package.json, GitHub Actions workflow files, and npm access settings. This setup ensures secure authentication and proper integration with versioning tools like changesets or release-please.