Hi Product Hunt! 👋 I’m KhvichaDev, a Solution Architect and the creator of npm Trusted Publisher. As developers, we all love building and sharing npm packages. But let's be honest: managing long-lived NPM_TOKEN secrets across multiple GitHub repositories is a security headache, and manually writing CI/CD workflows for every small utility is tedious. I wanted a "set it and forget it" solution, so I built this tool. 🛠️ npm Trusted Publisher is a zero-config CLI that instantly scaffolds a highly secure, automated publishing pipeline directly into your project. Here is what it does out of the box: 🔒 Secretless Authentication: Uses GitHub OIDC to connect with npm (No tokens required!). 🛡️ Provenance Tracking: Automatically generates cryptographic attestations for your packages. 🔄 Smart Versioning: Syncs your package.json exactly with your GitHub Release tags. 📜 Auto-Changelog: Extracts release notes and updates your CHANGELOG.md file. How to use it? Just go to your project terminal and run: npx npm-trusted-publisher init Or, simply download the workflow file and drop it directly into your repository. That's it! I built this open-source tool to save time and elevate security standards for the community. I would love to hear your thoughts, feedback, or any feature requests. Happy publishing! 🚀

npm Trusted Publisher

Secure, secretless npm publishing CLI via GitHub OIDC

Secure, secretless npm publishing CLI via GitHub OIDC