go-tokenless

Delete your NPM_TOKEN. One command switches npm publishing in GitHub Actions to trusted publishing (OIDC). No long-lived token is stored anywhere, and every release gets a provenance badge.

npm is retiring token publishing: from January 2027 a token can no longer publish on its own (npm docs).

Contents

• Quick start
• What it changes
• Supported release setups
• Private packages
• Keep it tokenless in CI
• Use it with AI agents
• Options
• What it accesses
• What only you can do
• Troubleshooting
• Contributing
• License

Quick start

From the root of the repository that publishes to npm:

npx go-tokenless          # 1. preview: lists every change and shows a diff, writes nothing
npx go-tokenless apply    # 2. edit the workflow and package.json files

Then follow the Next steps it prints: commit the change, connect the package to the workflow on npm, and delete the old secret. Needs Node 22.14+.

What it changes

Only the lines that need to change are touched: comments, quoting and layout in your workflows are kept, and in package.json only the repository field is edited. Before writing, go-tokenless re-reads both versions and refuses if anything other than the migration would change.

It stops with exit code 1 and writes nothing when a person needs to decide:

• Publishing reachable by outsiders: a publish job in a workflow started by pull_request_target, issue_comment, workflow_run and similar triggers. Granting it OIDC would let a fork publish.
• Self-hosted runners, which npm doesn't accept for trusted publishing.
• repository pointing at another repo.
• YAML anchors. Edits could leak into other job

... View full README on GitHub