Publishing packages

Projects using this template use GitHub Releases as the source of truth for releases. Package publishing can be added as a separate workflow triggered when a Release becomes public.

Publishing to npm Registry

name: Publish package
on:
  release:
    types: [published]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v7
      - uses: actions/setup-node@v7
        with:
          node-version: "24"

      - run: npm ci
      - run: npm test

      - run: npm publish --ignore-scripts

Using pnpm

Replace the setup and publish steps. pnpm install runs automatically when a package.json is present.

-     - uses: actions/setup-node@v7
-       with:
-         node-version: "24"
+     - uses: pnpm/setup@v2
+       with:
+         cache: true

-     - run: npm ci

-     - run: npm test
+     - run: pnpm test

-     - run: npm publish --ignore-scripts
+     - run: pnpm publish --no-git-checks

Publishing to GitHub Packages

Update the workflow as follows:

    permissions:
      contents: read
-     id-token: write
+     packages: write

...

      - run: npm publish --ignore-scripts
+       env:
+         NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Using pnpm

With pnpm v11+, configure GitHub Packages authentication before publishing:

+     - run: pnpm config set //npm.pkg.github.com/:_authToken "${{ secrets.GITHUB_TOKEN }}"
      - run: pnpm publish --no-git-checks

Provenance (npm Registry only)

Provenance statements provide verifiable information about how a package was built.

For more information, see the official npm documentation…

Warning

Provenance generation requires the package to be public.

      - run: npm publish --ignore-scripts
+       env:
+         NPM_CONFIG_PROVENANCE: true

Using pnpm

      - run: pnpm publish --no-git-checks
+       env:
+         NPM_CONFIG_PROVENANCE: true