publish-npm-package

Automate npm package publishing via GitHub Actions with OIDC authentication.

11|Updated Mar 8, 2026

Search Tags:#automation #ci/cd #npm #github actions #release #provenance #publish

Ready to run

npx skills add https://github.com/yigitkonur/skills-by-yigitkonur --skill publish-npm-package

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: publish-npm-package
Source: https://github.com/yigitkonur/skills-by-yigitkonur/tree/main/skills/publish-npm-package
Command: npx skills add https://github.com/yigitkonur/skills-by-yigitkonur --skill publish-npm-package

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill automates the process of publishing npm packages via GitHub Actions, removing the need for manual npm login and npm publish commands and ensuring secure, repeatable releases.

Core Features & Use Cases

Secure Authentication: Supports OIDC trusted publishing (zero secrets) or granular access tokens.
Flexible Versioning: Integrates with semantic-release, changesets, and release-please for automated or human-gated versioning.
Provenance: Enforces supply-chain security by generating cryptographic attestations for published packages.
Use Case: Ensure your open-source library is reliably published to npm every time a new version is merged to main, complete with security attestations and a GitHub release.

Quick Start

Use the publish-npm-package skill to set up automated npm publishing for your package using OIDC authentication and semantic-release.

Frequently Asked Questions about publish-npm-package

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I automate npm package publishing via GitHub Actions?▼

Automate npm package publishing via GitHub Actions by configuring workflow files to run release commands upon merging to main, removing manual npm login and publish commands. This skill supports semantic-release, changesets, and release-please for reliable, repeatable releases.

What is OIDC trusted publishing for npm packages?▼

OIDC trusted publishing for npm packages is a secure authentication method that enables zero-secrets automated releases via GitHub Actions. It eliminates the need for long-lived access tokens by establishing a trust relationship between your GitHub workflow and npm registry.

How does provenance attestation work for npm releases?▼

Provenance attestation for npm releases works by generating cryptographic attestations during the GitHub Actions publishing process. It enforces supply-chain security by proving the package origin and build integrity, ensuring reliable and secure releases.

Can I use semantic-release with GitHub Actions to publish npm packages?▼

Yes, you can use semantic-release with GitHub Actions to publish npm packages. This skill supports flexible versioning strategies including semantic-release, changesets, and release-please, allowing for automated or human-gated versioning for open-source libraries.

Do I need granular access tokens to publish npm packages in CI/CD?▼

You do not necessarily need granular access tokens to publish npm packages in CI/CD. This skill supports OIDC trusted publishing for zero-secrets authentication, but also integrates granular access tokens if your specific npm access settings require them.

What configuration is required for reliable npm publishing workflows?▼

Reliable npm publishing workflows require careful configuration of package.json, GitHub Actions workflow files, and npm access settings. This setup ensures secure authentication and proper integration with versioning tools like changesets or release-please.