Use npm trusted publishing to connect a package to a specific GitHub repository and workflow, then let GitHub Actions authenticate with an OIDC identity token. Configure the trusted publisher in npm, grant the publishing job id-token: write, run on a GitHub-hosted runner with npm CLI 11.5.1 or newer and Node.js 22.14.0 or newer, and publish with npm publish. For a public package published from a public repository, npm automatically creates and publishes a provenance attestation.
Provenance makes the package’s source repository and build context verifiable. It is not a security certification, malware scan, code review, or guarantee that the package is safe.
As an Amazon Associate I earn from qualifying purchases.
What npm provenance proves
An npm provenance attestation records where a package was built and how the publication was connected to its source. Consumers can inspect the package’s provenance information on npm and follow the source and build details back to GitHub Actions.
The attestation answers an origin question: did this package come from the repository and workflow that the maintainer declared? It does not answer whether the source contains a vulnerability, whether a dependency is trustworthy, or whether the release process produced bug-free code. Continue to use code review, dependency controls, tests, and security scanning as separate safeguards.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
The current preferred implementation is npm trusted publishing. It uses GitHub’s OIDC identity instead of a long-lived npm write token in the release job. Once the relationship is configured, npm can authenticate the workflow and generate provenance automatically for eligible publications.
Requirements before you configure it
- You must have maintainer or equivalent write access to the npm package.
- The package’s
repository.urlvalue inpackage.jsonmust exactly identify the GitHub repository that will publish it. Check the owner or organization, repository name, spelling, and capitalization. - The package and repository must meet npm’s visibility requirements for automatic trusted-publishing provenance: both must be public.
- The release must run on a GitHub-hosted runner. Self-hosted runners are not currently supported for npm trusted publishing.
- Use npm CLI 11.5.1 or newer and Node.js 22.14.0 or newer for trusted publishing.
- The workflow must be able to mint an OIDC token, which requires the
id-token: writepermission. - If the workflow installs private dependencies, prepare a separate read-only credential for installation. OIDC trusted publishing authenticates the publication; it does not grant access to private dependencies.
These requirements apply to the publishing path. Your normal package build, test, and release checks still need to be defined in the repository.
Configure the npm trusted publisher
1. Verify the repository metadata
Open the package repository and inspect package.json. The repository.url entry should point to the exact GitHub repository that will run the release workflow. A mismatch between the metadata and the repository declared in npm’s trusted-publisher settings can cause the first publication to fail.
Recommended Free Tools
Do this before creating the connection. npm checks the identity presented by the workflow against the configured owner, repository, workflow filename, and optional environment.
2. Create the connection in npm package settings
- Open the package’s settings on npm.
- Create a GitHub Actions trusted publisher.
- Enter the GitHub username or organization exactly as it appears in the repository address.
- Enter the repository name.
- Enter the workflow filename, including its
.ymlor.yamlextension. Enter only the filename, not the.github/workflows/directory path. - If the workflow uses a GitHub deployment environment, enter that environment name as well. Leave it out when the job does not use an environment.
- Save the configuration.
Case and spelling matter. npm does not validate every identity detail when you save the form; the first publish is where a mismatch is normally exposed. Existing trusted-publisher connections cannot be edited in place. If an owner, repository, workflow filename, or environment is wrong, delete the connection and create a new one.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
3. Observe the first-use window
A newly created trusted-publisher configuration must complete its first successful publish within two days. If it expires before a successful validation, delete it, create it again, and complete a publish within the new window.
Give the GitHub Actions job the right identity
Add id-token: write to the workflow or publishing job. This permission allows GitHub Actions to mint the OIDC identity token npm uses for trusted publishing. Keep all other permissions as narrow as the release needs; a typical release workflow also grants contents: read so the checkout step can read the repository.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not add an npm write token merely because older release workflows used one. Trusted publishing is designed to remove that long-lived publish credential from the job. A separate read-only token may still be needed when installation pulls private packages.
Use a GitHub-hosted release workflow
The following shape follows npm’s official example. It publishes when a version tag beginning with v is pushed, disables package-manager caching for the release build, installs dependencies, builds when a build script exists, runs tests, and then publishes. Review every third-party action and pin actions to reviewed versions or commit SHAs according to your repository’s security policy.
name: Publish Package
on:
push:
tags:
- 'v*'
permissions:
id-token: write
contents: read
jobs:
publish:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
with:
node-version: '24'
registry-url: 'https://registry.npmjs.org'
package-manager-cache: false
- run: npm ci
- run: npm run build --if-present
- run: npm test
- run: npm publishThe example uses Node.js 24, which satisfies the documented Node.js 22.14.0 minimum. Confirm the current npm and action versions before copying the workflow unchanged. The important properties are the GitHub-hosted runner, a supported Node and npm combination, the OIDC permission, and a publish command executed by the configured workflow.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Build and test before publishing
Place compilation, packaging, linting, and tests before npm publish. If your package has no build script, npm run build --if-present exits without treating the missing script as an error. Keep the release trigger and versioning policy explicit so a failed check cannot silently publish an incomplete artifact.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Use staged publishing when review is required
With npm staged publishing, CI submits a version for maintainer review before it becomes generally available. Staged-publish and direct-publish permissions are configured separately for a trusted publisher. Use the command documented for your configured staged workflow, commonly npm stage publish, and verify the current npm guidance before changing a production release process.
Publish and verify the attestation
- Push a release tag that matches the workflow trigger, or start the workflow through the repository’s approved release mechanism.
- Confirm that checkout, dependency installation, build, and tests complete successfully.
- Let the publishing step run
npm publish. With trusted publishing, npm obtains the OIDC identity and handles the attestation; an npm write token and an explicit--provenanceflag are not required for this path. - Open the package’s provenance information on npm after the release.
- Check that the displayed repository and build details point to the intended source and workflow. Treat a missing or mismatched link as a release incident to investigate before distributing the version further.
npm describes the behavior this way: “When you publish using trusted publishing from GitHub Actions or GitLab CI/CD, npm automatically generates and publishes provenance attestations for your package.” The automatic behavior remains conditional on the supported setup and visibility requirements.
When automatic provenance does and does not apply
Public repository and public package
This is the normal eligibility case for automatic provenance through npm trusted publishing from GitHub Actions. Configure the exact publisher identity, use a supported hosted runner and toolchain, and publish through the trusted workflow.
Public package in a private repository
A public package published from a private repository does not receive provenance through this trusted-publishing feature. The package’s public visibility alone is not sufficient.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Self-hosted runner
Self-hosted runners are not currently supported by npm trusted publishing. Move the publication job to a GitHub-hosted runner if you need this OIDC-based path.
Reusable or called workflows
Pay attention to which workflow identity npm validates when a reusable workflow is invoked. The caller’s repository and workflow context may be the identity presented to npm, so the trusted-publisher configuration must match the workflow that npm actually sees rather than only the file containing the shared steps.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Trusted publishing versus manual provenance
npm also documents a manual provenance route using npm publish --provenance. It is useful when you are following npm’s provenance workflow outside the trusted-publisher configuration, but it has different credential and environment requirements.
| Characteristic | npm trusted publishing | Manual provenance |
|---|---|---|
| Authentication model | OIDC identity from the configured GitHub Actions publisher; no long-lived npm write token is required for the publish step. | Uses the documented hosted CI and OIDC prerequisites and commonly retains token authentication for publication. |
| Attestation setup | Automatic for eligible GitHub Actions publications after the trusted publisher is configured. | Requested explicitly with npm publish --provenance. |
| Visibility requirement | Automatic GitHub Actions provenance requires a public repository and public package. | Check npm’s current provenance guidance for the package visibility and environment you are using. |
| Runner support | GitHub-hosted runners are supported; self-hosted runners are not currently supported. | Requires a supported cloud provider or hosted CI environment with OIDC support. |
| Long-lived publish credential in the job | Not needed for the trusted publish operation. | Often remains part of the documented token-based publication setup. |
Do not combine manual flags and trusted-publishing behavior casually. Select one documented release design, then verify its current npm requirements before rollout. Provenance itself does not make either design a security guarantee.
Optional CLI setup with npm trust
The npm trust github command can create the GitHub relationship from the command line. Its setup requirements are stricter than the general trusted-publishing minimum: use npm CLI 11.15.0 or newer, have package write permission, enable account-level two-factor authentication, and supply explicit permission such as --allow-publish or --allow-stage-publish.
Keep the distinction clear: npm CLI 11.5.1 and Node.js 22.14.0 are the current minimums for trusted publishing generally, while npm CLI 11.15.0 is the minimum stated for the npm trust configuration command.
Strengthen the release after it works
- Use protected GitHub environments for production publication and require the appropriate reviewers.
- Protect release tags so only approved actors or automation can create them.
- Keep workflow permissions minimal; grant only the OIDC and repository permissions required by the job.
- Audit trusted-publisher configurations periodically and remove unused connections.
- Remove obsolete npm publish tokens after trusted publishing is proven, rather than leaving dormant write credentials available.
- Consider restricted token publishing access for any remaining token-based operations.
- Separate dependency-read credentials from publication credentials. A read-only token for private installs should never be reused as a write credential.
- If you manage dist-tags, configure that permission explicitly for the trusted publisher. Dist-tag operations are separate from publishing permission and may require a newer npm CLI than the publish workflow itself.
Troubleshoot common failures
ENEEDAUTH or an authentication failure
- Check that the job has
id-token: writeat the effective workflow or job level. - Confirm the runner is GitHub-hosted, not self-hosted.
- Verify the configured owner or organization, repository, workflow filename, and optional environment character-for-character, including case.
- Enter only the workflow filename in npm’s settings, including
.ymlor.yaml; do not enter the directory path. - Check that the workflow file really resides under
.github/workflows/. - Compare
repository.urlinpackage.jsonwith the repository configured as the trusted publisher. - If a reusable workflow is involved, determine whether npm is validating the caller’s identity and configure the publisher accordingly.
The connection saved but the first publish fails
Saving the npm form does not prove that the identity is usable. Recheck every field and the workflow trigger, then run a real publication within the two-day first-use window. If the configuration has expired, delete it and create it again.
Provenance is missing
Confirm that both the package and repository are public, that the release ran through the trusted GitHub Actions publisher, and that the package was not published from an unsupported self-hosted runner. Also inspect the package’s repository metadata and the provenance view for a source mismatch.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePrivate dependency installation fails
Publishing authentication and dependency access are separate. Add the narrowly scoped, read-only credential required by the package manager for private dependencies; do not expect the OIDC publish identity to authorize installation.
Dist-tag commands are denied
Managing tags is a separate capability. Explicitly enable dist-tag operations for the trusted publisher and verify the npm CLI version required by the current npm documentation.
Quick Recap
Release checklist
- Confirm
repository.urlexactly matches the GitHub repository. - Create a trusted publisher with the exact owner, repository, workflow filename, and optional environment.
- Use the connection within two days for its first successful publish.
- Run the job on a GitHub-hosted runner with npm CLI 11.5.1 or newer and Node.js 22.14.0 or newer.
- Grant
id-token: writeand keep other permissions restricted. - Install dependencies, build, and test before publication.
- Publish with
npm publishor the configured staged-publish command, without adding an unnecessary npm write token or manual provenance flag. - Inspect npm’s provenance information and stop the release if the source or workflow identity is unexpected.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
