npm Trusted Publishing with GitHub Actions (No NPM_TOKEN)

I frequently create developer tools and publish node packages on npmjs. In late 2025 npm revoked every classic access token, capped granular tokens at 90 days, and switched 2FA on by default for publishing. The full list is in this GitHub announcement. The practical effect for anyone publishing from CI: the token you pasted into a GitHub secret years ago is dead, and the replacement expires every few weeks.

The way out is trusted publishing. npm uses OpenID Connect (OIDC) to verify that a publish request really comes from a specific GitHub Actions workflow in a specific repository. No API key, no access token, nothing to rotate, and every release gets a provenance attestation for free.

This is the setup I use for my own packages. It takes three steps.

What is npm trusted publishing?

Trusted publishing is a way to publish an npm package from CI without storing an npm token anywhere. GitHub Actions mints a short-lived OIDC token for each job. npm checks that token against the repository and workflow filename you registered on the package’s settings page. If they match, npm publish goes through, and the package gets a provenance statement linking it to the exact commit and workflow run that built it.

It has been generally available for GitHub Actions and GitLab CI since July 2025. The requirements:

• npm CLI 11.5.1 or newer (Node 22 is the easy way to get there)
• a GitHub-hosted runner (self-hosted runners are not supported)
• id-token: write permission on the job
• a package that already exists on npmjs.com (more on that below)

Step 1: Setup a Node Package (or skip if you already have one)

As an example, we’ll create a fresh package which just logs “hello world” to console.

mkdir npm-oidc-demo && cd npm-oidc-demo
npm init -y
touch index.js

index.js:

export function helloWorld() {
    console.log("Hello World");
}

package.json:

{
  "name": "npm-oidc-demo",
  "version": "1.0.1",
  "description": "A simple hello world package",
  "main": "index.js",
  "type": "module",
  "exports": {
    ".": "./index.js"
  },
  "repository": {
    "type": "git",
    "url": "https://github.com/ankushKun/npm-oidc-demo"
  },
  "keywords": [
    "npm",
    "oidc"
  ],
  "author": "",
  "license": "ISC"
}

Run npm login and follow the steps to link the npm CLI with your npmjs account. When successful, run npm whoami and it should print your username.

Ready for publishing:

If you ignored the previous note and still followed this guide to publish the demo package yourself, you might need to change your package name as I have already used “npm-oidc-demo”

$ npm whoami
ankushkun

$ npm publish
npm notice 
npm notice 📦  [email protected]
...
+ [email protected]

The package is now available at https://www.npmjs.com/package/npm-oidc-demo.

Step 2: Update OIDC Details on Package Settings

Head over to the settings tab on your freshly published package and select GitHub Actions as the trusted publisher.

I have already created a GitHub repo at ankushKun/npm-oidc-demo, now we just need to create a workflow file. Put this inside .github/workflows/publish.yml:

publish.yml:

name: Publish to npm

on:
  release:
    types: [published]
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: "22.x"
          registry-url: "https://registry.npmjs.org"

      - name: Update npm
        run: npm install -g npm@latest

      - name: Publish to npm
        run: npm publish

Push the YAML file to the repo and update the OIDC details on the package settings. The workflow filename you enter on npm (publish.yml here) has to match the file in .github/workflows/ exactly. I have kept the environment name empty because I don’t have any explicit environment setup for actions.

Notice what is not in that workflow: no NPM_TOKEN secret, no NODE_AUTH_TOKEN, no --provenance flag. Provenance is generated automatically when publishing over OIDC.

update and save the settings.

Now when you create a new release on the github repo, a workflow will start running which will publish the package to npm with provenance.

Step 3: Create a Release on GitHub to Run the Action

Now it’s time to trigger the workflow! Go back to the github repo and create a new release.

Once created, the GitHub Action will automatically start running. You can monitor the progress in the Actions tab of your repository.

When the workflow completes successfully, your package will be published to npm with provenance, proving it was built and published through your trusted CI/CD pipeline!

And that’s how one can setup cicd to publish npm packages from github actions without having to create any access tokens themselves!

Gotchas the docs skip

These are the things that cost me, or people who emailed me, an afternoon each.

• A leftover token wins over OIDC. If NPM_TOKEN or NODE_AUTH_TOKEN is set in the job’s environment, the npm CLI uses it and never tries OIDC. Delete the secret from the repository and remove any env: lines that reference it.
• Old npm, old error. On an npm CLI below 11.5.1 you get a plain ENEEDAUTH as if nothing was configured. The npm install -g npm@latest step in the workflow is not optional.
• The first publish is a chicken-and-egg problem. The trusted publisher setting lives on the package’s page, so the package has to exist first. Publish once from your machine, then hand over to CI.
• Unused configurations expire. Since October 2026 a trusted publisher that has not completed a successful publish within 48 hours of being created is removed. Create the config and cut a release the same day.
• Reusable workflows. With workflow_call, register the caller workflow (the one that runs on release), not the shared one it calls.
• Configurations cannot be edited. To change the repo, workflow or environment, delete the trusted publisher and add a new one. A package can have at most ten.
• Yarn v1 says “Not found”. That is an authentication error in disguise. Publish with the npm CLI in the workflow even if the project uses Yarn for everything else.
• Private dependencies still need a read token. OIDC covers publishing only. If npm ci has to pull private packages, give it a read-only granular token with the shortest expiry you can live with.

Timeline of the npm token changes

Searchers keep landing here asking when exactly classic tokens stopped working, so here is the sequence, newest first.

The driver behind the September to December 2025 changes was the Shai-Hulud supply-chain worm, which spread through stolen long-lived npm tokens. Trusted publishing closes that door because there is no long-lived token to steal.

Summary

Publish once by hand, register the GitHub Actions workflow as a trusted publisher on npmjs.com, give the job id-token: write, and keep npm current. From then on a GitHub release publishes the package with provenance and nothing to rotate. The demo repository is at ankushKun/npm-oidc-demo if you want a copy-paste starting point.