Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    trusted publishing

    1

    Set up and debug OIDC trusted publishing for npm and PyPI releases via GitHub Actions.

    Free

    Security scanned
    trusted publishing

    trusted publishing

    Example session with this skill installed

    My GitHub Action is failing to publish to npm with a 403 error, even though I added the id-token permission. Can you check my workflow and help me switch to trusted publishing?

    • Read your context and instructions
    • Compiled the trusted publishing

    I have analyzed your workflow. The 403 error is likely caused by a mismatch between your GitHub environment name and the configuration on npmjs.com, or an outdated npm version in the runner. I have updated the workflow to use Node 24, force-update npm, and added a version-match safety check.

    Updated GitHub Actions Workflow

    name: Release
on:
  push:
    tags: ["v*"]

jobs:
  publish:
    if: startsWith(github.ref, 'refs/tags/v')
    runs-on: ubuntu-latest
    environment: npm
    permissions:
      id-token: write
      contents: read
    steps:
      - uses: actions/checkout@v5
      - uses: actions/setup-node@v5
        with:
          node-version: "24"
          registry-url: "https://registry.npmjs.org"
      - run: npm install -g npm@latest
      - run: npm ci
      - name: Verify version match
        run: |
          [ "${GITHUB_REF_NAME#v}" = "$(node -p "require('./package.json').version")" ] \

            || { echo "Tag $GITHUB_REF_NAME does not match package.json version"; exit 1; }

      - run: npm publish --provenance --access public

    Next steps

    1. Go to Package Settings > Trusted Publishing on npmjs.com and ensure the environment name is exactly npm.
    2. Verify that the workflow filename in the npm settings matches your .yml file path.
    3. Delete the old NPM_TOKEN from your GitHub Secrets after the first successful OIDC run.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Tokenless releases provide better security than long-lived secrets, but the setup is prone to silent failures. Most OIDC issues manifest as generic authentication errors, leaving developers guessing about version mismatches, environment name collisions, or outdated CLI versions. This skill eliminates the trial-and-error of configuring GitHub Actions for npm and PyPI.

    What it does

    • Configures OIDC trusted publishing to replace vulnerable NPM_TOKEN and PyPI API secrets with short-lived GitHub tokens.
    • Enforces provenance and SLSA by integrating --provenance flags and automated attestations into the release flow.
    • Debugs OIDC failures by identifying mismatches between job environments, workflow filenames, and registry configurations.
    • Validates release integrity through pre-publish checks that ensure tags match package.json versions to prevent irreversible failures.
    • Orchestrates MCP Registry updates by managing version synchronization across server.json and package manifests.

    How it works

    1. Analyze existing workflows to identify token-based auth or failing OIDC configurations.
    2. Apply registry-specific rules such as the npm 11.5.1 requirement and id-token: write permissions.
    3. Insert safety guards that run npm pack and version comparisons before the irreversible publish step.
    4. Deploy dedicated workflows for multi-destination releases to ensure individual failures can be retried.

    Frameworks & tools

    GitHub Actions, npm, PyPI, OIDC, Node.js, Python, and the Model Context Protocol (MCP).

    Why this beats prompting it yourself

    Generic prompts often miss the specific Node 22/npm 10 trap where the bundled npm version lacks OIDC support. This skill includes the specific tag-matching logic and workflow partitioning strategies that prevent broken, unfixable releases.

    Use cases

    • Migrating a repository from legacy secrets to tokenless OIDC publishing.
    • Troubleshooting EOTP or 403 errors in a GitHub Actions publish job.
    • Setting up an MCP server for automated npm and MCP Registry distribution.
    • Adding SLSA provenance to a Python or JavaScript package build.

    Known limitations

    Does not support registries other than npmjs.com and pypi.org. Requires GitHub Actions as the CI provider. Environment-based OIDC claims may conflict with ref-based consumers like the MCP Registry.

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Free forever

    No account required to browse

    Trust & safety

    Security scanned

    Verified clean 2 days ago

    • Free to download with an account

    Requires

    GitHub Actions
    Node.js 24+ (for npm packages)
    Python 3 (for PyPI packages)

    Listed2 days ago

    What's inside

    Frequently Asked Questions