Run any Skill in Manus with one click

actions-npm

Use when creating or debugging GitHub Actions workflows that publish npm packages with trusted publishing / OIDC. Triggers on npm publish in CI, ENEEDAUTH, E404 or E422 during publish, tag-triggered releases, setup-node auth behavior, or provenance issues in public vs private GitHub repositories.

Run Skill in Manus

Overview

Install command

npx skills add https://github.com/JsonLee12138/prompts --skill actions-npm

Copy and paste this command into Claude Code to install the skill

Source

JsonLee12138/prompts

Stars2

Forks0

UpdatedMay 11, 2026 at 07:16

File Explorer

2 files

SKILL.md

readonly

name	actions-npm
description	Use when creating or debugging GitHub Actions workflows that publish npm packages with trusted publishing / OIDC. Triggers on npm publish in CI, ENEEDAUTH, E404 or E422 during publish, tag-triggered releases, setup-node auth behavior, or provenance issues in public vs private GitHub repositories.

Actions NPM Publish (Trusted Publishing)

Workflow Template

See assets/release-npm.yml — 可直接复制到 .github/workflows/ 使用。

How It Works

trusted publishing 用 GitHub OIDC 替代长期有效的 NPM_TOKEN：

workflow 运行在 GitHub-hosted runner 上
job 具备 permissions.id-token: write
npm / actions/setup-node 用 GitHub OIDC 身份换取发布凭证
npm publish 使用该凭证发布

不需要 NPM_TOKEN secret。

Verified Requirements

workflow 必须在 .github/workflows/
必须使用 GitHub-hosted runner
必须有 id-token: write
npm trusted publisher 必须精确匹配仓库和 workflow 文件名，例如 release-auth-sdk.yml
package.json.repository.url 必须匹配 GitHub 仓库 URL
推荐 actions/setup-node@v6
推荐 Node 24；如果保留 Node 22，需确认 npm 已升级到 11.5.1+

Important Gotchas

使用 actions/setup-node@v6 时，不要再手动设置 NODE_AUTH_TOKEN: ""。按实测，这种组合会导致 ENEEDAUTH；优先让 setup-node 自己处理发布凭证。
npm notice Publishing to https://registry.npmjs.org/ 之后再报 E404，通常说明认证已经通过，但 npm 侧的包权限、scope 权限，或 trusted publisher 元数据仍不匹配。
E422 ... Unsupported GitHub Actions source repository visibility: "private" 表示 private GitHub 仓库不支持 --provenance。此时去掉 --provenance，保留普通 trusted publishing 即可。
provenance 目前只适用于 public source repository。

Publish Command

public GitHub repo: npm publish --provenance --access public
private GitHub repo: npm publish --access public

Quick Checklist

actions/setup-node@v6
node-version: "24"
registry-url: https://registry.npmjs.org/
不配置 NPM_TOKEN
不手动覆盖 NODE_AUTH_TOKEN
npm 后台 trusted publisher 中的 workflow filename 与实际文件名完全一致

More from this repository

same repository

makefile

JsonLee12138/prompts

Use when creating, editing, or validating Makefiles. Provides templates for Go, Node, Python, Docker, and Monorepo projects with self-documenting help targets. Also validates existing Makefiles against conventions. Triggers on: Makefile, makefile, make help, validate makefile, lint makefile.

2026-04-232

claude-design

JsonLee12138/prompts

Unified design workflow router for critique, accessibility review, developer handoff, design system work, UX copy, user research, and research synthesis. Use when users ask naturally for design feedback, mockup review, a11y audit, handoff specs, UX writing, research planning, research synthesis, or mention Figma, Pencil, or HTML design workflows and should not need to invoke separate sub-skills manually.

2026-04-212

brainstorming

JsonLee12138/prompts

You MUST use this before any creative work - creating features, building components, adding functionality, or modifying behavior. Turn rough ideas into validated brainstorming/design docs through one-question-at-a-time dialogue, role-based analysis, and explicit user approval. Use when users ask to brainstorm, shape requirements, compare approaches, or produce a planning/design document before implementation.

2026-03-022

unocss-shadcn

JsonLee12138/prompts

Configure UnoCSS with unocss-preset-shadcn using a semi-automatic, framework-agnostic workflow. Use when setting up or updating UnoCSS + shadcn integration, deciding monorepo vs single-project component destinations, enforcing peerDependencies in monorepos, and requiring shadcn MCP + manual component creation mode.

2026-02-272

vite-tanstack

JsonLee12138/prompts

TanStack (Router/Query/Form/Table) configuration guide for Vite + React projects. Covers Vite plugin setup, main.tsx registration, DevTools configuration, and editor settings. Use when setting up or reviewing TanStack config in a Vite project. Triggers on: vite-tanstack, tanstack config, tanstack router setup, tanstack query setup, tanstack form setup, tanstack table setup.

2026-02-242

solo-ops

JsonLee12138/prompts

AI team role manager for multi-agent development workflows. Use when the user wants to create/delete team roles, open role sessions in WezTerm tabs, assign tasks to roles, check team status, or merge role branches. Triggers on /solo-ops commands, "create a team role", "open role session", "assign task to role", "show team status", "merge role branch".

2026-02-212

Source

JsonLee12138

JsonLee12138/prompts

View GitHub Repository View Creator Repositories

Install command

Download

Run Skill in Manus

Useful forSOC

Software DevelopersComputer and Mathematical Occupations15-1252L4

name	actions-npm
description	Use when creating or debugging GitHub Actions workflows that publish npm packages with trusted publishing / OIDC. Triggers on npm publish in CI, ENEEDAUTH, E404 or E422 during publish, tag-triggered releases, setup-node auth behavior, or provenance issues in public vs private GitHub repositories.

Actions NPM Publish (Trusted Publishing)

Workflow Template

See assets/release-npm.yml — 可直接复制到 .github/workflows/ 使用。

How It Works

trusted publishing 用 GitHub OIDC 替代长期有效的 NPM_TOKEN：

workflow 运行在 GitHub-hosted runner 上
job 具备 permissions.id-token: write
npm / actions/setup-node 用 GitHub OIDC 身份换取发布凭证
npm publish 使用该凭证发布

不需要 NPM_TOKEN secret。

Verified Requirements

workflow 必须在 .github/workflows/
必须使用 GitHub-hosted runner
必须有 id-token: write
npm trusted publisher 必须精确匹配仓库和 workflow 文件名，例如 release-auth-sdk.yml
package.json.repository.url 必须匹配 GitHub 仓库 URL
推荐 actions/setup-node@v6
推荐 Node 24；如果保留 Node 22，需确认 npm 已升级到 11.5.1+

Important Gotchas

使用 actions/setup-node@v6 时，不要再手动设置 NODE_AUTH_TOKEN: ""。按实测，这种组合会导致 ENEEDAUTH；优先让 setup-node 自己处理发布凭证。
npm notice Publishing to https://registry.npmjs.org/ 之后再报 E404，通常说明认证已经通过，但 npm 侧的包权限、scope 权限，或 trusted publisher 元数据仍不匹配。
E422 ... Unsupported GitHub Actions source repository visibility: "private" 表示 private GitHub 仓库不支持 --provenance。此时去掉 --provenance，保留普通 trusted publishing 即可。
provenance 目前只适用于 public source repository。

Publish Command

public GitHub repo: npm publish --provenance --access public
private GitHub repo: npm publish --access public

Quick Checklist

actions/setup-node@v6
node-version: "24"
registry-url: https://registry.npmjs.org/
不配置 NPM_TOKEN
不手动覆盖 NODE_AUTH_TOKEN
npm 后台 trusted publisher 中的 workflow filename 与实际文件名完全一致