iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Yes—you can publish an npm package from supported CI/CD systems without storing a long-lived npm write token. npm Trusted Publishing links a package to a specific hosted workflow through OpenID Connect (OIDC). When the workflow runs, the CI provider issues a short-lived, signed identity token; npm CLI exchanges it for temporary publish authorization.
This reduces the exposure and rotation burden of permanent write credentials, but it does not make an authorized workflow harmless or authenticate every npm command. You still need exact trust settings, supported runner and tool versions, protected release workflows, and separate read credentials when the build installs private packages.
What npm Trusted Publishing does
Trusted Publishing establishes a trust relationship between an npm package and an approved CI/CD identity. Instead of putting an npm automation token in a repository secret, you register the provider, repository or project, workflow, and optional environment in the package’s Trusted Publisher settings. At release time, the workflow requests an OIDC token from its provider. npm CLI recognizes that environment and exchanges the token for short-lived authorization to perform the operations enabled for that publisher.
npm’s official description is that Trusted Publishing lets packages be published directly from CI/CD with OIDC authentication, eliminating the need for long-lived npm tokens. The important qualification is scope: the authorization is for the configured package and workflow identity, and only for the actions you enable. It is not a general npm login that automatically covers installs, access management, or every command.
#1 Best Overall
- Powerful Turbo Fan:CAGIWIRU Electric Air Duster have reached speed up to 130000RPM,Can efficient remove dust and debris.With LED light and Three Adjustable Speed to meet with different cleaning tasks.
- With Attached USB C Fasting Charging cable.Charing 3 hours,Enjoy up to 240 minutes of use on the lowest setting, For third speed can use for 25mins.with four charging options to meet with your needs.
- Wide Application: attached 5 different nozzles,making it suitable for a variety of scenes, such as car,pet, pc, keyboards, and other electronic devices. It also serves for office and home clean duster.
- Handy Design & Portable:Cordless air duster electric nozzle is Light weight and small size, design and comfortable to hold and space saving, convenient to carry around. You can put it in your room or inside the car without taking up space.
- Economical &Reusable: Built durable materials with a long-lasting battery,our CAGIWIRU air duster it's a sustainable alternative to disposable air cans.
Why teams use it
- Less persistent secret material: a reusable write token does not have to sit in CI secret storage.
- Shorter credential lifetime: the publish authorization is issued for the workflow run rather than kept indefinitely.
- Narrower trust: npm can bind publishing to an exact provider identity, project, workflow file, and optional deployment environment.
- Lower rotation work: there is no long-lived publish token to rotate when a release credential reaches its normal replacement date.
These benefits depend on protecting the workflow itself. A compromised authorized workflow, an unsafe release trigger, or an unreviewed workflow change can still publish a malicious or unintended version.
How the OIDC publish exchange works
- Register the publisher. A maintainer adds the provider and exact identity fields to the package’s Trusted Publisher configuration, or manages it with the
npm trustCLI. - Start a release workflow. The CI system runs on a supported hosted environment and grants the job permission to request an OIDC identity token.
- Request the identity token. The provider signs a short-lived token describing the workflow, repository or project, and other claims used for validation.
- Exchange with npm. npm CLI detects the OIDC environment and presents the token to npm. npm checks it against the package’s trusted-publisher entry.
- Publish an enabled operation. If the claims match, npm issues temporary authorization for direct publishing, staged publishing, and any separately enabled dist-tag operation.
Authentication, provenance, and package safety are separate concepts. OIDC answers “which configured workflow is asking to publish?” Provenance records claims about where and how a qualifying build ran. Neither is proof that the source code is safe.
Supported providers, runners, and version requirements
As described in npm’s Trusted Publishing documentation accessed October 13, 2026, the supported providers are GitHub Actions on GitHub-hosted runners, GitLab CI/CD on GitLab.com shared runners, and CircleCI Cloud. Self-hosted runners are not currently supported. Provider availability and requirements can change, so verify the live npm guide before changing a production pipeline.
Free tools Windows power users keep installed
One-click scans. No signup required.
| Requirement | What the current documentation specifies |
|---|---|
| GitHub | GitHub Actions on GitHub-hosted runners |
| GitLab | GitLab CI/CD on GitLab.com shared runners |
| CircleCI | CircleCI Cloud |
| Self-hosted runners | Not currently supported |
| Publishing toolchain | npm CLI 11.5.1 or later and Node.js 22.14.0 or later |
npm trust configuration command |
npm CLI 11.15.0 or later |
| OIDC dist-tag operations | npm lists a newer minimum of 11.21.0 or 12.2.0, depending on the major version; check the live guide |
The 11.5.1 and Node.js 22.14.0 thresholds apply to the publishing overview. Do not treat them as the threshold for every trust-management or dist-tag feature.
Configure a trusted publisher in npm
1. Open the package’s Trusted Publisher settings
In npm package settings, add a trusted publisher and select the CI provider. Enter every identity field exactly as the provider presents it. npm says these fields are case-sensitive. A spelling difference, changed capitalization, wrong path, or different workflow filename causes validation to fail.
Rank #2
- Screen Cleaner is Your Screen’s New Bestfriend! - EVEO is proud to present a screen cleaner that’s perfectly suited for your TV. Meet your new screen cleaner, computer screen cleaner, laptop cleaner, iPad cleaner, Macbook,tv cleaner or any other electronic device. Our screen cleaner spray and wipe along with the included plush microfiber cloth, easily removes dust, fingerprints & other smudges on the screen’s surface. Clean effectively for a streak-free screen
- Gentle on your Screens - Our screen cleaner spray and wipes is compatible to be used even for the most sensitive LCD, LED, CRT, and OLED screens in proper use. Be at ease knowing that this product is compatible with all the major brands: LG, SONY, Samsung, Sharp, iPad, iPhone, Android screens, Kindle, PC monitors - we’ve got you covered! Can be used as LCD screen cleaner, tv cleaner, smart tv screen cleaner, and more
- Premium Super Soft Plush Microfiber Cloth - Included in this efficient screen cleaning kit. This screen cleaner spray and wipe has our signature plush microfiber cloth specially designed to comply with screens and monitors and leave them streak-free. Has been shown to effectively absorbs stubborn stains, zero streaks, and no fiber shedding. Always use this together with our screen cleaner for the best results
- Easy-to-Use Screen Cleaner Kit + microfiber cleaning cloth - The EVEO Screen Cleaning Kit will easily be your new favorite tool when it comes to taking care of the things you love most, quick and easy solution for a streak-free screen. Simply screw on the sprayer gun on the screen cleaner bottle. Spray the cleaning liquid onto the microfiber cloth, then wipe the screen until desired cleanliness & shine is achieved.
- Quality Screen Care Kit Worth Purchasing - Enjoy a convenient Screen Cleaner anytime, anywhere you need it. Your satisfaction is our top priority. We stand behind the quality of our products and that’s why, you shouldn’t be worrying at all. We manufacture the Best Screen Cleaner. and can be used for laptop cleaning kit, laptop screen cleaner, tv screen cleaner for smart tv. MacBook screen cleaner, monitor cleaner or screen cleaner spray for electronic devices with microfiber cleaning cloth
2. Enter provider-specific identity fields
| Provider | Required identity information | Optional field |
|---|---|---|
| GitHub Actions | Organization or user, repository, and workflow filename | Environment |
| GitLab CI/CD | Namespace, project, and top-level CI file path | Environment |
| CircleCI | Organization, project, pipeline definition IDs, and VCS origin | Context IDs |
A package can have up to 10 trusted-publisher configurations. Existing entries cannot be edited in place; delete the old entry and create a replacement when a provider or required identity field changes.
3. Choose allowed actions
Enable only what the release process needs. npm exposes direct npm publish, staged publishing, and, when separately enabled, dist-tag management. Stage-only access lets automation submit a package for review while a maintainer performs the final release through an interactive flow. This is useful when builds are automated but public release requires a human decision.
4. Complete the first publish promptly
npm says a new publisher configuration must complete its first successful publish within two days. If that validation window expires, delete the entry and create it again before retrying.
Configure OIDC in each CI provider
GitHub Actions
The workflow job needs the id-token: write permission. Keep the job on a GitHub-hosted runner and use the supported npm and Node.js versions.
permissions:
contents: read
id-token: write
jobs:
release:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- uses: actions/setup-node@v4
with:
node-version: 22.14.0
registry-url: https://registry.npmjs.org
- run: npm ci
- run: npm publishThe configured workflow filename must match the actual workflow. The package’s repository.url must also match the GitHub repository. If one workflow calls another, npm notes that validation may use the calling workflow name; set the required permissions on both the parent and child workflows where applicable.
Rank #3
- 【Large size】：Measuring 800 x 300 mm/ 31. 5×12 inches, which is wider and taller than others. Large mouse pad can perfectly fit your keyboard and mouse of any size, and there is also ample space for peripherals such as phones, tablets, etc.
- 【LED backlight mouse pad】：Blade Hawks RGB mouse pad provides 7 static modes and 7 dynamic modes will give you the options you are looking for. Power-off memory function remembers the last lighting mode you selected. The super glow fiber Chroma will give you a colorful gaming setup that you want.
- 【Anti-slip rubber base】：Made from Natural rubber, this gaming mousepad will firmly grip your desktop, allowing you to enjoy the ultimate precision in the games you are most passionate about. It also comes with a texture that enhances this ability even further.
- 【Smooth and waterproof surface】: Micro-textured cloth surface, for extremely precise mouse control and a smooth movement. When liquid splashes on the gaming mouse pad, it forms water droplets and slides down. Will not delay your work or gameplay.
- 【Plug and play】: This mouse and keyboard pad is powered by USB, plug and play, no driver required. One button control light modes. Press one time to change the lighting mode, press twice to change the brightness, press and hold about 3 seconds turn ON/OFF.
For release control, npm recommends deployment environments for approval requirements and tag protection to control who can create release tags.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
GitLab CI/CD
GitLab’s example requests an ID token with the audience exactly npm:registry.npmjs.org. The namespace, project, top-level CI file path, and optional environment in npm must match the pipeline identity.
release:
image: node:22
id_tokens:
NPM_ID_TOKEN:
aud: npm:registry.npmjs.org
script:
- npm ci
- npm publishUse GitLab.com shared runners, not a self-hosted runner, under the current support policy.
CircleCI Cloud
CircleCI’s flow obtains an OIDC token and exports it as NPM_ID_TOKEN for npm CLI to use. Register the organization, project, pipeline definition IDs, VCS origin, and any required context IDs exactly as they appear in CircleCI.
jobs:
publish:
docker:
- image: cimg/node:22.14
steps:
- checkout
- run: npm ci
- run: |
# Obtain the CircleCI OIDC token as NPM_ID_TOKEN
npm publishCircleCI trusted publishing currently does not automatically generate npm provenance attestations, unlike qualifying GitHub and GitLab publishes.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Rank #4
- 【Softer and More Comfortable】Vaydeer wrist rest has unique diamond pattern, which is the combination of softness and aesthetics. The materials of wrist rest are improved into higher quality memory foam and covered with silky smooth lycra. The computer wrist rest makes you as comfortable and cushiony as like rest your wrists on clouds.
- 【Ergonomic Wrist Saver】The wrist rests for keyboard and mouse comes with a 17.32×3.15×0.83 inch keyboard wrist pad and a 5.94×3.15×0.83 inch mouse wrist support. Based on ergonomic design, the unique concave shape is the perfect fit for your wrist joints. The wrist rest pad fits most computer keyboards and laptops, improve hand and wrist posture, release your wrist and arm stress.
- 【Non-Slip Rubber Bottom】Featuring an anti-skid silicone base on the bottom, this wrist keyboard support stays firmly in place on your desk, preventing the padding from sliding around, ensuring stable and consistent wrist support during extended computer sessions.
- 【Better Experience & Pain Relief】Our keyboard arm rest is beneficial to alleviate the soreness caused by direct contact and friction between your arm and a hard desk surface, reducing the risk of wrist fatigue or carpal tunnel. The soft texture of memory foam can evenly distribute the pressure around your wrists and provide good support with just enough give.
- 【Helpful in Multiple Scenarios】Whether you're working, studying, writing, typing, gaming, this keyboard and mouse rest combo is an essential accessory to add comfort and support to your hands and wrists. It’s also a great gift for men, women, family, friend, coworker, gamer, teacher, etc.
Do you still need an npm token in CI?
For the supported publish operation, no long-lived npm write token is required when Trusted Publishing is correctly configured and the workflow uses a supported environment. The workflow obtains authorization through OIDC for that run.
You may still need credentials for other tasks. If the build installs private dependencies, npm recommends a separate read-only granular token for installation. OIDC publishing does not authenticate commands such as private-package install or general account and access management. Keep the read credential limited to the packages and registries the build needs; do not reuse a publish credential for dependency reads.
| Operation | OIDC trusted publishing coverage |
|---|---|
| Direct package publish | Supported when enabled for the matching publisher |
| Staged publish | Supported when enabled |
| Configured dist-tag operation | Supported with the newer CLI requirement noted by npm |
| Install private dependencies | Still needs a suitable read credential |
npm whoami as a permission test |
Not a valid trusted-publisher test |
General access or account commands |
Not covered automatically |
Provenance: what it adds and what it does not
Qualifying Trusted Publishing runs from GitHub Actions and GitLab CI/CD automatically generate provenance attestations, according to npm. The documented eligibility conditions include publishing a public package from a public repository. A private repository is not eligible even when the package itself is public. CircleCI trusted publishing does not currently generate automatic provenance.
An attestation gives consumers a verifiable link between the package and claims about its source repository and build instructions. Consumers should inspect those claims as supply-chain evidence; provenance is not a safety certification and does not prove that the repository or dependencies are benign.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Security hardening for release workflows
Protect the identity that can publish
- Restrict who can modify the release workflow and package metadata.
- Use protected deployment environments for approval gates on GitHub where they fit your process.
- Protect release tags so an untrusted contributor cannot trigger a production publish.
- Review workflow triggers, especially pull-request, reusable-workflow, and manual-dispatch paths.
- Limit trusted-publisher actions to direct publish, staged publish, or dist-tags only when required.
Reduce legacy credential exposure
After a successful migration, audit traditional npm automation tokens. Revoke unused write tokens and consider npm’s recommendation to require two-factor authentication and disallow token-based publishing where that policy suits the package. Keep any retained read-only token separate from release authorization.
Best Value
- 【No Drill Mounted】Cable management tray can be assembled in as little as 3 minutes or less-simply. Side clips easily clampe the edge of desk, pass through the holes on the sides, and secure excess cables with baskets. Desk cable management supports inward or outward installation to meet your needs in different scenarios, and provides you with great convenience when collecting and organizing wires.
- 【Rubber Pad Protects Desk】Wire organizer under desk built-in soft rubber pads on the clamp protect your desk from scratches, so you will not damage your furniture or office.
- 【Sturdy and Beautiful】Cord management under desk is made of high-quality carbon steel and holds about 15 lbs. The wire basket has 2 holes on each side of the tray to enable your cables to pass freely. Cable baskets are suitable for desk thickness use from 0.4" to 2.4".
- 【Space Saving & Keep Organized】Desk cable management tray holds all your power cords, outlet strips, USB hubs and computer transformers hidden from your feet, and the data cables will not enter the vacuum cleaner to keep your desk clean and tidy. Desk wire organizer is also suitable for use in the kitchen and outdoors.
- 【Reduce Safety Risks】Cable tray under desk keeps all plugs away from your kids, no more worry about tripping. Using 2 holes wire tray saves extra space, helps you easily cabling and wire protection. The mesh design is not easy to accumulate dust, but avoids safety accidents caused by messy wires.
Troubleshoot a failed trusted publish
“Publisher does not match” or authorization failure
- Compare every case-sensitive field in npm with the provider: organization or namespace, repository or project, workflow or CI file path, and optional environment.
- Confirm the package’s GitHub
repository.urlpoints to the same repository used in the trusted-publisher entry. - Check that the job is running on a supported hosted runner.
- Verify npm CLI is at least 11.5.1 and Node.js is at least 22.14.0.
GitHub token request fails
Add id-token: write to the effective job permissions. For reusable workflows, check both the calling and called workflow permissions and confirm that the configured filename is the one npm validates.
GitLab token is rejected
Inspect the ID-token audience. It must be exactly npm:registry.npmjs.org, including punctuation and capitalization.
First publish never succeeds
Check the two-day validation window for a newly created configuration. If it has expired, delete the entry, recreate it with corrected fields, and run a real publish operation promptly.
Recommended Free Tools
npm whoami appears to fail
Do not use npm whoami to test trusted-publisher permissions. Run the intended publish or staged-publish operation in a controlled release workflow instead.
Dist-tag operation is rejected
Confirm that dist-tag access was separately enabled and that the CLI meets npm’s newer listed minimum—11.21.0 or 12.2.0 depending on the major version. Check the current npm guide for the exact version pairing before changing the runner.
Choosing among the supported providers
There is no independent benchmark in npm’s documentation that ranks GitHub, GitLab, or CircleCI for security or reliability. Choose based on the controls your team already operates.
| Decision factor | Questions to ask |
|---|---|
| Runner model | Can the release run on the provider’s supported hosted runner rather than a self-hosted machine? |
| Identity fields | Can your team keep the exact repository, project, workflow, file-path, and environment values stable? |
| Provenance | Do you publish a public package from a public repository and need automatic attestations? |
| Release approvals | Can the provider’s environments, contexts, or protected tags enforce your review process? |
| Actions | Do you need direct publish, stage-only submission, dist-tags, or a combination? |
| Toolchain | Can the pipeline use the npm CLI and Node.js versions required by the selected operation? |
A practical migration sequence
- Inventory the package’s current publish tokens, release triggers, private dependencies, and repository visibility.
- Upgrade the release image to Node.js 22.14.0 or later and npm CLI 11.5.1 or later; use npm 11.15.0 or later if managing the relationship with
npm trust. - Create a trusted-publisher entry with exact, case-sensitive provider fields.
- Enable only the required publish actions, choosing stage-only access if a human must approve the final release.
- Add the provider’s OIDC permission and run a controlled release before the two-day entry window expires.
- Verify the actual publish result and, where eligible, inspect the generated provenance attestation.
- Provide a separate read-only granular token if the workflow installs private dependencies.
- Revoke unused write tokens, review workflow and tag protections, and document who can change the trusted-publisher configuration.
Trusted Publishing is therefore a change in how npm verifies the release identity, not a replacement for disciplined CI/CD security. OIDC removes a persistent publish secret from the workflow, while exact identity matching, protected release controls, least-privilege actions, and separate dependency-read credentials determine whether the resulting pipeline is dependable.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
