I Publish npm Packages With No Tokens Stored Anywhere — Here's the Setup

Description and use

The author published an npm package without storing any tokens, using GitHub OIDC for trusted publishing and Sigstore for provenance, achieving secure, verifiable releases.

Problem

Using long‑lived npm tokens in CI exposes a credential that can be stolen and used to publish malicious versions of a package.

Outcome

The author published SolAudit 0.3.0 without storing any npm token, achieving zero‑credential publishing and cryptographic provenance in about 30 minutes.

Workflow

• Configure trusted publishing on npm by adding repository owner, name, workflow filename, and optional environment.
• Create a GitHub Actions workflow that sets permissions: id-token: write, checks out code, sets up Node, installs dependencies, builds the CLI bundle, upgrades npm to latest, and runs npm publish.
• Trigger the workflow manually via workflow_dispatch after bumping the version and merging to main.
• Verify provenance by running npm audit signatures and checking the npm package page for the green provenance badge.

Evidence

The publish step involved zero secrets. No npm token in GitHub Actions secrets. No token on my laptop. No token anywhere.

Source

Trusted publishing controls who can publish. Provenance lets everyone else verify what was published.

Source

Three details matter: permissions: id-token: write, no NODE_AUTH_TOKEN, npm install -g npm@latest.

Source