What is an npm Trusted Publisher?

A Trusted Publisher allows you to authenticate your npm releases from GitHub Actions using OIDC, which is more secure than using static, long-lived authentication tokens.

How does npm-trustme handle authentication?

It uses Playwright to open a real browser session, allowing you to perform the required one-time WebAuthn or security key approval needed by the npm registry.

What are the system requirements for this skill?

This skill requires Node.js version 22 or higher and the installation of Playwright browsers via 'npx playwright install'.

Can I use npm-trustme in automated CI environments?

While the initial setup requires a browser for WebAuthn, once configured, the Trusted Publisher allows your CI/CD environment to publish without manual intervention.

NPM Trusted Publisher Automator

Name: NPM Trusted Publisher Automator
Author: regenrek

byregenrek

•

Deployment & DevOps

Automates the setup and verification of npm Trusted Publishers for GitHub Actions using browser-driven CLI tools.

About

npm-trustme is a specialized tool designed to simplify the manual process of configuring OIDC-based Trusted Publishers on npm. By leveraging Playwright browser automation, it handles the complex parts of the npm web UI setup, including guiding users through WebAuthn requirements and passkey approvals. It provides a robust set of commands to ensure, check, and initialize GitHub Actions workflows, making it an essential utility for developers looking to replace long-lived npm tokens with secure, short-lived OIDC credentials.

Key Features

Automated Trusted Publisher configuration for GitHub Actions
Flexible browser automation with Playwright and Chrome profile support
3 GitHub stars
Automatic generation of release workflows
Verification and 'doctor' checks for npm publishing health
Persistent authentication storage and cookie management

Use Cases

Securing npm package releases by migrating from legacy tokens to OIDC Trusted Publishers.
Bootstrapping new projects with pre-configured GitHub Actions for automated deployment.
Auditing existing repository configurations to ensure publishing security compliance.

About

Key Features

Automated Trusted Publisher configuration for GitHub Actions
Flexible browser automation with Playwright and Chrome profile support
3 GitHub stars
Automatic generation of release workflows
Verification and 'doctor' checks for npm publishing health
Persistent authentication storage and cookie management

Use Cases

Securing npm package releases by migrating from legacy tokens to OIDC Trusted Publishers.
Bootstrapping new projects with pre-configured GitHub Actions for automated deployment.
Auditing existing repository configurations to ensure publishing security compliance.