Публикация npm-пакетов через OIDC без токенов

★ 8.0 · vibe-coding

npm-trusted-publishing is a Claude Code skill that guides you through setting up npm package publishing via GitHub Actions using OIDC trusted publishing instead of long-lived NPM_TOKEN secrets. It covers the full pipeline: granting the `id-token: write` permission, adding the `--provenance` flag for provenance attestations, setting the correct `git+https://` format for `repository.url` in package.json, and configuring a trusted publisher for each package on npmjs.com. A dedicated section addresses a common pitfall — outdated npm on GitHub Actions runners that produces a misleading E404 error instead of a clear OIDC message — with a step to run `npm install -g npm@latest` before publishing. Monorepo setups are supported via the `directory` field in package.json.