npm-publish-oidc.md

NPM publish using OIDC on github actions

➊ NPM Settings

➋ Github Action Settings

➌ .github/workflows/ci.yml

➍ Proper permissions are required.

permissions:
  contents: write
  id-token: write

Complete configuration

jobs:
  npm-publish:
    runs-on: ubuntu-latest
    permissions:
      contents: write
      id-token: write
      
    steps:
      - uses: actions/checkout@v6
      - uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: 'https://registry.npmjs.org'

      # npm@v11.5.0+ is required for OIDC support
      # node@v22.0.0+ 
      # - name: Upgrade npm for OIDC support
      #   run: npm install -g npm@latest
      
      # node@v24.0.0+ 
      # https://github.com/orgs/community/discussions/176761
      # https://github.com/actions/setup-node/issues/1440#issuecomment-3571890875
      - run: NODE_AUTH_TOKEN="" npm publish --access public --provenance
        name: 📦 hotkeys-js to NPM
        continue-on-error: true

• https://github.com/orgs/community/discussions/176761
• actions/setup-node#1440 (comment)

Thanks for the guide. It finally helped me fix my OIDC issue 🎉
This should really be in npm’s troubleshooting section.

The NODE_AUTH_TOKEN="" did the trick for me!