Skip to content

feat: add support for npm Trusted Publishers with NPM_ID_TOKEN #227

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
meesvandongen wants to merge 4 commits into
base: main
Choose a base branch
from
Open

feat: add support for npm Trusted Publishers with NPM_ID_TOKEN #227

Changes from 1 commit
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d8321bc
feat: add support for npm Trusted Publishers with NPM_ID_TOKEN
meesvandongen Oct 5, 2025
730655b
feat: add support for npm Trusted Publishers with NPM_ID_TOKEN
meesvandongen Oct 5, 2025
192838d
Merge branch 'main' of https://github.com/meesvandongen/changesets-gi…
meesvandongen Oct 5, 2025
1e3d823
Update README.md
meesvandongen Oct 5, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Update README.md 
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
  • Loading branch information
@meesvandongen @coderabbitai
meesvandongen and coderabbitai[bot] authored Oct 5, 2025
commit 1e3d823c42bf38fd0a3d35dbcac2a5c24a4eefb6
2 changes: 1 addition & 1 deletion README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -91,7 +91,7 @@ release:

There are two ways to authenticate with npm when publishing:

1. Trusted Publishers (recommended): Configure npm Trusted Publishers for your GitLab pipeline (see the npm docs: https://docs.npmjs.com/trusted-publishers#supported-cicd-providers). When the pipeline runs, npm will inject an `NPM_ID_TOKEN`, which this tool detects. In this mode you do NOT need to set `NPM_TOKEN`, and no `.npmrc` file is required—the npm CLI exchanges the identity token automatically.
1. Trusted Publishers (recommended): Configure npm Trusted Publishers for your GitLab pipeline (see the npm docs: <https://docs.npmjs.com/trusted-publishers#supported-cicd-providers>). When the pipeline runs, npm will inject an `NPM_ID_TOKEN`, which this tool detects. In this mode you do NOT need to set `NPM_TOKEN`, and no `.npmrc` file is required—the npm CLI exchanges the identity token automatically.
2. Classic Automation Token: Create an [npm automation token](https://docs.npmjs.com/creating-and-viewing-authentication-tokens) (without 2FA on publish) and add it as a [custom environment variable in GitLab](https://docs.gitlab.com/ee/ci/variables/#custom-cicd-variables) named `NPM_TOKEN`.

For any of the methods, create a file at `.gitlab-ci.yml` with the following content:
Expand Down
Loading