Three gates before your first npm publish: 2FA, provenance, and staged releases

说明与用途

npm 包发布会遇到三道隐藏门：2FA、来源证明和 staged 发布。作者说明如何通过 CI 和受信任发布来绕过每一道门。

问题

Publishing a new npm package can fail at multiple hidden gates, causing confusion and delays.

结果

The developer successfully published the plugin, enabled provenance, and understood staged publishing mechanics, reducing future publish failures.

工作流

• 1. Run npm whoami to verify token validity.
• 2. If publishing a new name, use a direct publish token and run npm publish interactively.
• 3. For provenance, add "provenance": true in publishConfig and publish from CI with --provenance and permissions: id-token: write.
• 4. Configure trusted publisher with npm trust github my-package --file publish.yml --repo my-org/my-repo --allow-publish.
• 5. For staged releases, use a stage‑only token and run npm stage publish after the first direct publish.
• 6. After publishing, wait for propagation and verify with curl https://registry.npmjs.org/my-package/0.1.0.
• 7. Update dist‑tags if needed with npm dist-tag add [email protected] latest.

证据

The account had 2FA set up with a security key, not a TOTP app.

来源

Automatic provenance generation not supported for provider: null

来源

Cannot publish "my-package": this token can only publish to a staging area, npm error and "my-package" does not exist yet.

来源