Support Trusted Publishing

[jdgamble555]

You can have 2FA on if you have Trusted Publishing.

This should support trusted publishing as well.

J

[andrii-kravets-x]

This may be of interest to you:
https://github.com/withastro/astro/blob/ad3265daf8651c6e15243f5ba85165da5ca4652d/.github/workflows/release.yml#L47

[jdgamble555]

Thanks, actually found what I needed here. This should be updated in the main docs since this is going to be the new norm:

https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow

J

[ryanbas21]

I wrote #545 which should help. Basically if no npm_token is in the environment, dont append it to the npmrc file. that way its not required for passing in. if its required and not passed in npm publishing should fail

[tomwayson]

The above comments helped me get trusted publishing to work w/ this action, but I needed to do a little more.

Documenting the key changes here in case it helps others:

1. use NPM_TOKEN: '' so the action doesn't pass undefined as the token (may not be needed if fix: conditionally append NPM_TOKEN to .npmrc for trusted publishing … #545 gets merged)
2. add a step to my workflow that updates to npm >= 11.5.1 (as per https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow)
3. use NPM_CONFIG_PROVENANCE: false b/c we use hosted runners which do not support provenance

We already had the workflow configured w/ the id-token: write permission, but that is also required.

[mzvast]

The above comments helped me get trusted publishing to work w/ this action, but I needed to do a little more.

Documenting the key changes here in case it helps others:

1. use NPM_TOKEN: '' so the action doesn't pass undefined as the token (may not be needed if fix: conditionally append NPM_TOKEN to .npmrc for trusted publishing … #545 gets merged)
2. add a step to my workflow that updates to npm >= 11.5.1 (as per https://docs.npmjs.com/trusted-publishers#step-2-configure-your-cicd-workflow)
3. use NPM_CONFIG_PROVENANCE: false b/c we use hosted runners which do not support provenance

We already had the workflow configured w/ the id-token: write permission, but that is also required.

realy helpful.

I got error when my npm version is lower so add like this works. Also can update node to 24 but it's more risky~

     - name: Setup node.js
        uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: 'https://registry.npmjs.org'
          cache: "pnpm"

      - name: Update npm
        run: npm install -g npm@'>=11.5.1' // got a newer npom

[ksr20612]

i'm still struggling with it..
not working with NPM_TOKEN: '' & 'NPM_CONFIG_PROVENANCE: false

npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm notice publish Signed provenance statement with source and build information from GitHub Actions
npm notice publish Provenance statement published to transparency log: https://search.sigstore.dev/?logIndex=779414736
npm notice Access token expired or revoked. Please try logging in again.

according to error logs, it seems that mine still uses Access Token.