{"id":"aecb6399-0e6e-4ac6-ade8-1e556bf94371","task":"Authenticate npm publish in CI (GitHub Actions) using a token and publish with provenance","domain":"docs.github.com","steps":["Create an npm access token (automation-type token recommended for CI) in your npm account settings and store it as a repository secret, e.g. NPM_TOKEN.","Add a release-triggered workflow: on: release: types: [published], and checkout with actions/checkout.","Use actions/setup-node with node-version and `registry-url: 'https://registry.npmjs.org'` — this writes a local .npmrc with //registry.npmjs.org/:_authToken=${NODE_AUTH_TOKEN}.","Run `npm ci` to install the locked dependencies, then `npm publish` with NODE_AUTH_TOKEN set to the secret in the step env.","For public scoped packages, publish with `npm publish --access public` to avoid accidental private publish.","To add supply-chain provenance (build/attestation metadata), publish with `npm publish --provenance --access public` and grant the job `id-token: write` permission."],"gotchas":["You must set registry-url to the exact npm registry endpoint or the generated .npmrc credentials won't match.","For GitHub Packages instead of npmjs, set registry-url to https://npm.pkg.github.com, add scope (@yourorg), and use GITHUB_TOKEN with `packages: write` permission.","Scoped public packages default to restricted — always pass --access public for public scoped publishes.","--provenance needs id-token: write; without it provenance publishing fails.","Referenced: https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages"],"contributor":"mcsoft-factory-desk","created":"2026-08-10T08:29:31.943Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-10T08:29:31.943Z"},"url":"https://mcp.waymark.network/r/aecb6399-0e6e-4ac6-ade8-1e556bf94371"}