SkillsAdd

jsonlee12138/prompts · Archived

actions-npm

Use when creating or debugging GitHub Actions workflows that publish npm packages with trusted publishing / OIDC.

First seen Jun 4, 2026

Installation

$ npx skills add jsonlee12138/prompts --skill actions-npm
View on skills.sh ↗ GitHub repository ↗

Summary

  • Use when creating or debugging GitHub Actions workflows that publish npm packages with trusted publishing / OIDC.
  • Triggers on npm publish in CI, ENEEDAUTH, E404 or E422 during publish, tag-triggered releases, setup-node auth behavior, or provenance issues in public vs private GitHub repositories.

Stronger alternatives

This repository is archived — consider an actively maintained alternative.

design-patterns-principles Same source · more installs
jsonlee12138/prompts

Use when a request asks for software design patterns or design principles, including explanatio…

17 installs
vite-tanstack Same source · more installs
jsonlee12138/prompts

TanStack (Router/Query/Form/Table) configuration guide for Vite + React projects.

16 installs
eslint-config Same source · more installs
jsonlee12138/prompts

Use when configuring ESLint with @antfu/eslint-config for a single project or a monorepo worksp…

11 installs
unocss-shadcn Same source · more installs
jsonlee12138/prompts

Configure UnoCSS with unocss-preset-shadcn using a semi-automatic, framework-agnostic workflow.

9 installs

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

agent-browser Shared topics
vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…

810.4K installs
azure-aigateway Shared topics
microsoft/azure-skills

Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: sem…

566.3K installs
azure-compute Shared topics
microsoft/azure-skills

Azure VM/VMSS router. WHEN: create / provision / deploy / spin-up VM, recommend VM size, compar…

510K installs
supabase-postgres-best-practices Shared topics
supabase/agent-skills

Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill …

391.6K installs
prisma-cli Shared topics
prisma/skills

Prisma ORM CLI commands reference covering init, generate, migrate, db, dev, complete, studio, …

267K installs
supabase Shared topics
supabase/agent-skills

Use when doing ANY task involving Supabase. Triggers: Supabase products (Database, Auth, Edge F…

263K installs

Also in this package

Other skills from jsonlee12138/prompts · top by installs.

npx skills add jsonlee12138/prompts
design-patterns-principles 17 vite-tanstack 16 eslint-config 11 unocss-shadcn 9 brainstorming 4 claude-design 1 solo-ops 1 skill-creator 1 makefile 1 components 1

Browse all from jsonlee12138/prompts

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 2
License LICENSE
Default branch main
Open issues 0
Status Archived

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 2,331 B
  • docs SUMMARY.md 316 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 1 installs

SKILL.md

Actions NPM Publish (Trusted Publishing)

Workflow Template

See [assets/release-npm.yml](assets/release-npm.yml) — 可直接复制到 .github/workflows/ 使用。

How It Works

trusted publishing 用 GitHub OIDC 替代长期有效的 NPM_TOKEN：

  1. workflow 运行在 GitHub-hosted runner 上
  2. job 具备 permissions.id-token: write
  3. npm / actions/setup-node 用 GitHub OIDC 身份换取发布凭证
  4. npm publish 使用该凭证发布

不需要 NPM_TOKEN secret。

Verified Requirements

  • workflow 必须在 .github/workflows/
  • 必须使用 GitHub-hosted runner
  • 必须有 id-token: write
  • npm trusted publisher 必须精确匹配仓库和 workflow 文件名，例如 release-auth-sdk.yml
  • package.json.repository.url 必须匹配 GitHub 仓库 URL
  • 推荐 actions/setup-node@v6
  • 推荐 Node 24；如果保留 Node 22，需确认 npm 已升级到 11.5.1+

Important Gotchas

  • 使用 actions/setup-node@v6 时，不要再手动设置 NODEAUTHTOKEN: ""。按实测，这种组合会导致 ENEEDAUTH；优先让 setup-node 自己处理发布凭证。
  • npm notice Publishing to https://registry.npmjs.org/ 之后再报 E404，通常说明认证已经通过，但 npm 侧的包权限、scope 权限，或 trusted publisher 元数据仍不匹配。
  • E422 ... Unsupported GitHub Actions source repository visibility: "private" 表示 private GitHub 仓库不支持 --provenance。此时去掉 --provenance，保留普通 trusted publishing 即可。
  • provenance 目前只适用于 public source repository。

Publish Command

  • public GitHub repo: npm publish --provenance --access public
  • private GitHub repo: npm publish --access public

Quick Checklist

  • actions/setup-node@v6
  • node-version: "24"
  • registry-url: https://registry.npmjs.org/
  • 不配置 NPM_TOKEN
  • 不手动覆盖 NODEAUTHTOKEN
  • npm 后台 trusted publisher 中的 workflow filename 与实际文件名完全一致