Skip to Content
The Public InterfaceSeptember 12, 2026

The Public Interface

December 17, 2025

NPM Trusted Publishing

How to publish with provenance to NPM using GitHub Actions and Changesets.

By Ross Robinonpm / workspaces / publish

NPM security requirements recently got an upgrade, meaning package authors need to adjust their publishing workflows if they were using NPM tokens. I encountered a few issues migrating my projects so here are my notes on how I’ve set up my release automation with GitHub Actions, Turborepo, Changesets.

I’ll walk through the process of upgrading a css library I maintain called uico, here’s the repository if you want to see more details.

If you see any errors or improvements in this tutorial, please create an issue or PR.

My file structure is a basic monorepo setup with NPM workspaces and turbo.

To create a GitHub action, add a .github/workflows/release.yml file with the workflow you want to execute. I’ve adapted this one from the latest one in the SvelteKit repository.

Previously I had an NPM_TOKEN value, which I have now removed since we can utilize Trusted Publishing.

Navigate to your repository on GitHub: https://github.com/rossrobino/uico

Select Settings, then in the side panel select Actions - General. Select Allow all actions and reusable workflows for Actions Permissions, and Read and write permissions for Workflow Permissions. Also check the option to Allow GitHub Actions to create and approve pull requests, this allows changesets to create the PR

If your repo is within an org, you may need to enable these options at the org level first if they are disabled.

If you previously had an NPM secret token saved under the Security - Secrets and variables - Actions section, you can remove it since it’s no longer valid.

Next navigate to your package on npm: https://www.npmjs.com/package/uico

Login, and select the Settings tab, under Trusted Publisher select GitHub Actions and enter in the required information. The Workflow Filename in this case is release.yml.

If this is the only way your package should be published, you can select Require two-factor authentication and disallow tokens (recommended) and update your package settings.

Provenance will automatically be setup since we specified NPM_CONFIG_PROVENANCE: true in the release.yml file.

Now when you make a change to your library that you want to release, make a changeset and commit it to your main branch. From here, changesets will run and open a PR to modify the version numbers of your package accordingly, remove the changesets, and publish the release once the PR is merged.

You can continue to edit or add more changesets and merge the PR when you are ready.…

Continue reading

In brief

Package Your TSConfig

How to publish and share your TypeScript configuration between projects.

Your project will need to contain at minimum a package.json and another .json file containing your shared TSConfig. I have one TSConfig that I use in library development with tsc and another in app development when using a bundler. I have also included a README.md and a LICENSE.md. Here are a couple of helpful fields that make it easier to share your TSConfig between projects.

January 17, 2025

Create a Svelte Component Library

How to create a npm package with SvelteKit to share your components between projects.

This post was updated on Mar 22, 2023 to account for the changes in svelte-package 2.0. This update simplified the process for setting up a component library. See instructions on migrating an existing project here. You can also now find more information on svelte-package in the documentation. If you frequently have components that you share between projects and want to keep a single repository of them, you can create a package on npm. Here’s how to create a Svelte component library with SvelteKit.

January 12, 2023

Interactively Update NPM Dependencies

Keeping up with your project's dependencies can be difficult and time consuming. Here's the best way I've found to keep up with them.

Keeping up with a project’s dependencies can be difficult and time consuming. After trying a variety of methods, here’s the best way I’ve found to manage npm dependencies with npm-check-updates. Add this script to your package.json, you can name it whatever you prefer, I name mine deps. Alternatively, you can run the script in the command line directly.

September 12, 2022