npm Trusted Publishing (OIDC)

Configure and debug secure, tokenless npm publishing from GitHub Actions using OpenID Connect (OIDC) and Provenance.

Core Requirements

Trusted Publishing eliminates the need for long-lived NPM_TOKEN secrets by using short-lived, cryptographically-signed tokens.

1. GitHub Actions Permissions (CRITICAL)

The workflow MUST grant id-token: write permissions to fetch the OIDC token. This can be declared globally at the top level of the file or inside the target job block.

permissions:
  id-token: write # Required for OIDC provenance authentication
  contents: read  # Required for repository checkout

2. Node.js Version

Trusted Publishing with provenance requires a modern Node.js environment (v20+) and npm v9.5.0+. Using standard runner defaults or .nvmrc configurations works reliably.