Compare commits

...

11 Commits

Author SHA1 Message Date
claude-ceo-assistant bbc031c413 chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:27:48 +00:00
claude-ceo-assistant 6fea761ab7 chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:27:47 +00:00
claude-ceo-assistant 54397b260f chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:27:47 +00:00
claude-ceo-assistant 87d5daafd2 chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:27:46 +00:00
claude-ceo-assistant 77db4a4d4b chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:27:46 +00:00
claude-ceo-assistant 79cadd90df chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:27:45 +00:00
claude-ceo-assistant ebb60c5677 chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:27:45 +00:00
claude-ceo-assistant 52f5e1dc97 chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:27:44 +00:00
claude-ceo-assistant 779595e5c5 chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:27:44 +00:00
claude-ceo-assistant 94efa52bb2 chore: remove upstream CI workflows (mirror inertization per internal#233) 2026-05-10 14:27:43 +00:00
Chiranjib Swain 670825a89d Add documentation for publishing to npm with Trusted Publisher (OIDC) (#1536)
CodeQL analysis / CodeQL analysis (push) Failing after 1s
Licensed / Licensed (push) Failing after 2s
2026-04-22 21:58:57 -05:00
12 changed files with 40 additions and 774 deletions
-19
View File
@@ -1,19 +0,0 @@
name: Basic validation
on:
pull_request:
paths-ignore:
- '**.md'
push:
branches:
- main
- releases/*
paths-ignore:
- '**.md'
jobs:
call-basic-validation:
name: Basic validation
uses: actions/reusable-workflows/.github/workflows/basic-validation.yml@main
with:
node-version: '24.x'
-19
View File
@@ -1,19 +0,0 @@
name: Check dist
on:
push:
branches:
- main
paths-ignore:
- '**.md'
pull_request:
paths-ignore:
- '**.md'
workflow_dispatch:
jobs:
call-check-dist:
name: Check dist/
uses: actions/reusable-workflows/.github/workflows/check-dist.yml@main
with:
node-version: '24.x'
-14
View File
@@ -1,14 +0,0 @@
name: CodeQL analysis
on:
push:
branches: [main]
pull_request:
branches: [main]
schedule:
- cron: '0 3 * * 0'
jobs:
call-codeQL-analysis:
name: CodeQL analysis
uses: actions/reusable-workflows/.github/workflows/codeql-analysis.yml@main
-304
View File
@@ -1,304 +0,0 @@
name: e2e-cache
on:
pull_request:
paths-ignore:
- '**.md'
push:
branches:
- main
- releases/*
paths-ignore:
- '**.md'
jobs:
node-npm-depencies-caching:
name: Test npm (Node ${{ matrix.node-version}}, ${{ matrix.os }})
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
steps:
- uses: actions/checkout@v6
- name: Clean global cache
run: npm cache clean --force
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
cache: 'npm'
- name: Install dependencies
run: npm install
- name: Verify node and npm
run: __tests__/verify-node.sh "${{ matrix.node-version }}"
shell: bash
node-pnpm-depencies-caching:
name: Test pnpm (Node ${{ matrix.node-version}}, ${{ matrix.os }})
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
steps:
- uses: actions/checkout@v6
- name: Install pnpm
uses: pnpm/action-setup@v4
with:
version: 6.10.0
- name: Generate pnpm file
run: pnpm install
- name: Remove dependencies
shell: pwsh
run: Remove-Item node_modules -Force -Recurse
- name: Clean global cache
run: rm -rf ~/.pnpm-store
shell: bash
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
cache: 'pnpm'
- name: Install dependencies
run: pnpm install
- name: Verify node and pnpm
run: __tests__/verify-node.sh "${{ matrix.node-version }}"
shell: bash
node-yarn1-depencies-caching:
name: Test yarn 1 (Node ${{ matrix.node-version}}, ${{ matrix.os }})
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
steps:
- uses: actions/checkout@v6
- name: Yarn version
run: yarn --version
- name: Generate yarn file
run: yarn install --ignore-engines
- name: Remove dependencies
shell: pwsh
run: Remove-Item node_modules -Force -Recurse
- name: Clean global cache
run: yarn cache clean
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
cache: 'yarn'
- name: Install dependencies
run: yarn install --ignore-engines
- name: Verify node and yarn
run: __tests__/verify-node.sh "${{ matrix.node-version }}"
shell: bash
node-yarn3-depencies-caching:
name: Test yarn 3 (Node ${{ matrix.node-version}}, ${{ matrix.os }})
runs-on: ${{ matrix.os }}
env:
YARN_ENABLE_IMMUTABLE_INSTALLS: false
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
steps:
- uses: actions/checkout@v6
- name: Update yarn
run: yarn set version 3.6.4
- name: Yarn version
run: yarn --version
- name: Generate simple .yarnrc.yml
run: |
echo "nodeLinker: node-modules" >> .yarnrc.yml
- name: Generate yarn file
run: yarn install
- name: Remove dependencies
shell: pwsh
run: Remove-Item node_modules -Force -Recurse
- name: Clean global cache
run: yarn cache clean --all
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
cache: 'yarn'
- name: Install dependencies
run: yarn install
- name: Verify node and yarn
run: __tests__/verify-node.sh "${{ matrix.node-version }}"
shell: bash
yarn-subprojects:
name: Test yarn subprojects
strategy:
matrix:
node-version: [20, 22, 24]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: prepare sub-projects
run: __tests__/prepare-yarn-subprojects.sh yarn1
# expect
# - no errors
# - log
# ##[debug]Cache Paths:
# ##[debug]["sub2/.yarn/cache","sub3/.yarn/cache","../../../.cache/yarn/v6"]
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
cache: 'yarn'
cache-dependency-path: |
**/*.lock
yarn.lock
yarn-subprojects-berry-local:
name: Test yarn subprojects all locally managed
strategy:
matrix:
node-version: [20, 22, 24]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: prepare sub-projects
run: __tests__/prepare-yarn-subprojects.sh keepcache keepcache
# expect
# - no errors
# - log
# ##[info]All dependencies are managed locally by yarn3, the previous cache can be used
# ##[debug]["node-cache-Linux-yarn-401024703386272f1a950c9f014cbb1bb79a7a5b6e1fb00e8b90d06734af41ee","node-cache-Linux-yarn"]
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
cache: 'yarn'
cache-dependency-path: |
sub2/*.lock
sub3/*.lock
yarn-subprojects-berry-global:
name: Test yarn subprojects some locally managed
strategy:
matrix:
node-version: [20, 22, 24]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: prepare sub-projects
run: __tests__/prepare-yarn-subprojects.sh global
# expect
# - no errors
# - log must
# ##[debug]"/home/runner/work/setup-node-test/setup-node-test/sub2" dependencies are managed by yarn 3 locally
# ##[debug]"/home/runner/work/setup-node-test/setup-node-test/sub3" dependencies are not managed by yarn 3 locally
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
cache: 'yarn'
cache-dependency-path: |
sub2/*.lock
sub3/*.lock
yarn-subprojects-berry-git:
name: Test yarn subprojects managed by git
strategy:
matrix:
node-version: [20, 22, 24]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v6
- name: prepare sub-projects
run: /bin/bash __tests__/prepare-yarn-subprojects.sh keepcache
# expect
# - no errors
# - log
# [debug]"/home/runner/work/setup-node-test/setup-node-test/sub2" has .yarn/cache - dependencies are kept in the repository
# [debug]"/home/runner/work/setup-node-test/setup-node-test/sub3" has .yarn/cache - dependencies are kept in the repository
# [debug]["node-cache-Linux-yarn-401024703386272f1a950c9f014cbb1bb79a7a5b6e1fb00e8b90d06734af41ee"]
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
cache: 'yarn'
cache-dependency-path: |
sub2/*.lock
sub3/*.lock
node-npm-packageManager-auto-cache:
name: Test auto cache with top-level packageManager
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
steps:
- uses: actions/checkout@v6
- name: Create package.json with packageManager field
run: |
echo '{ "name": "test-project", "version": "1.0.0", "packageManager": "npm@8.0.0" }' > package.json
- name: Clean global cache
run: npm cache clean --force
- name: Setup Node with caching enabled
uses: ./
with:
node-version: ${{ matrix.node-version }}
- name: Install dependencies
run: npm install
- name: Verify node and npm
run: __tests__/verify-node.sh "${{ matrix.node-version }}"
shell: bash
node-npm-devEngines-auto-cache:
name: Test auto cache with devEngines.packageManager
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
steps:
- uses: actions/checkout@v6
- name: Create package.json with devEngines field
run: |
echo '{
"name": "test-project",
"version": "1.0.0",
"devEngines": {
"packageManager": {
"name": "npm",
"onFail": "error"
}
}
}' > package.json
- name: Clean global cache
run: npm cache clean --force
- name: Setup Node with caching enabled
uses: ./
with:
node-version: ${{ matrix.node-version }}
- name: Install dependencies
run: npm install
- name: Verify node and npm
run: __tests__/verify-node.sh "${{ matrix.node-version }}"
shell: bash
-15
View File
@@ -1,15 +0,0 @@
name: Licensed
on:
push:
branches:
- main
pull_request:
branches:
- main
workflow_dispatch:
jobs:
call-licensed:
name: Licensed
uses: actions/reusable-workflows/.github/workflows/licensed.yml@main
-52
View File
@@ -1,52 +0,0 @@
name: proxy
on:
pull_request:
paths-ignore:
- '**.md'
push:
branches:
- main
- releases/*
paths-ignore:
- '**.md'
jobs:
test-proxy:
runs-on: ubuntu-latest
container:
image: ubuntu:latest
options: --dns 127.0.0.1
services:
squid-proxy:
image: ubuntu/squid:latest
ports:
- 3128:3128
env:
https_proxy: http://squid-proxy:3128
steps:
- uses: actions/checkout@v6
- name: Clear tool cache
run: rm -rf $RUNNER_TOOL_CACHE/*
- name: Setup node 24
uses: ./
with:
node-version: 24.x
- name: Verify node and npm
run: __tests__/verify-node.sh 24
test-bypass-proxy:
runs-on: ubuntu-latest
env:
https_proxy: http://no-such-proxy:3128
no_proxy: api.github.com,github.com,nodejs.org,registry.npmjs.org,*.s3.amazonaws.com,s3.amazonaws.com
steps:
- uses: actions/checkout@v6
- name: Clear tool cache
run: rm -rf $RUNNER_TOOL_CACHE/*
- name: Setup node 24
uses: ./
with:
node-version: 24
- name: Verify node and npm
run: __tests__/verify-node.sh 24
@@ -1,20 +0,0 @@
name: 'Publish Immutable Action Version'
on:
release:
types: [published]
jobs:
publish:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
packages: write
steps:
- name: Checking out
uses: actions/checkout@v6
- name: Publish
id: publish
uses: actions/publish-immutable-action@v0.0.4
@@ -1,28 +0,0 @@
name: Release new action version
on:
release:
types: [released]
workflow_dispatch:
inputs:
TAG_NAME:
description: 'Tag name that the major tag will point to'
required: true
env:
TAG_NAME: ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }}
permissions:
contents: write
jobs:
update_tag:
name: Update the major tag to include the ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }} changes
environment:
name: releaseNewActionVersion
runs-on: ubuntu-latest
steps:
- name: Update the ${{ env.TAG_NAME }} tag
uses: actions/publish-action@v0.4.0
with:
source-tag: ${{ env.TAG_NAME }}
slack-webhook: ${{ secrets.SLACK_WEBHOOK }}
-11
View File
@@ -1,11 +0,0 @@
name: Update configuration files
on:
schedule:
- cron: '0 3 * * 0'
workflow_dispatch:
jobs:
call-update-configuration-files:
name: Update configuration files
uses: actions/reusable-workflows/.github/workflows/update-config-files.yml@main
-292
View File
@@ -1,292 +0,0 @@
name: versions
on:
pull_request:
paths-ignore:
- '**.md'
push:
branches:
- main
- releases/*
paths-ignore:
- '**.md'
jobs:
local-cache:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
steps:
- uses: actions/checkout@v6
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
- name: Verify node and npm
run: __tests__/verify-node.sh "${{ matrix.node-version }}"
shell: bash
lts-syntax:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest-large]
node-version: [lts/dubnium, lts/erbium, lts/fermium, lts/*, lts/-1]
steps:
- uses: actions/checkout@v6
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
check-latest: true
- if: runner.os != 'Windows' && runner.os != 'macOS'
name: Verify node and npm
run: |
. "$NVM_DIR/nvm.sh"
[[ $(nvm version-remote "${{ matrix.node-version }}") =~ ^v([^.]+) ]]
__tests__/verify-node.sh "${BASH_REMATCH[1]}"
shell: bash
v8-canary-syntax:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version:
[
'20-v8-canary',
'20.0.0-v8-canary',
'20.0.0-v8-canary20221101e50e45c9f8'
]
steps:
- uses: actions/checkout@v6
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
- name: Verify node and npm
run: |
canaryVersion="${{ matrix.node-version }}"
majorVersion=$(echo $canaryVersion | cut -d- -f1)
__tests__/verify-node.sh "$majorVersion"
shell: bash
nightly-syntax:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20-nightly, 25-nightly, 24.0.0-nightly]
steps:
- uses: actions/checkout@v6
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
- name: Verify node and npm
run: |
nightlyVersion="${{ matrix.node-version }}"
majorVersion=$(echo $nightlyVersion | cut -d- -f1)
__tests__/verify-node.sh "$majorVersion"
shell: bash
rc-syntax:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20.0.0-rc.1, 22.14.0-rc.1, 24.0.0-rc.4]
steps:
- uses: actions/checkout@v6
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
- name: Verify node and npm
run: |
rcVersion="${{ matrix.node-version }}"
majorVersion=$(echo $rcVersion | cut -d- -f1)
__tests__/verify-node.sh "$majorVersion"
shell: bash
manifest:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20.10.0, 22.0.0, 24.9.0]
steps:
- uses: actions/checkout@v6
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
- name: Verify node and npm
run: __tests__/verify-node.sh "${{ matrix.node-version }}"
shell: bash
check-latest:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [20, 22, 24]
steps:
- uses: actions/checkout@v6
- name: Setup Node and check latest
uses: ./
with:
node-version: ${{ matrix.node-version }}
check-latest: true
- name: Verify node and npm
run: __tests__/verify-node.sh "${{ matrix.node-version }}"
shell: bash
version-file:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version-file:
[.nvmrc, .tool-versions, .tool-versions-node, package.json]
steps:
- uses: actions/checkout@v6
- name: Setup node from node version file
uses: ./
with:
node-version-file: '__tests__/data/${{ matrix.node-version-file }}'
- name: Verify node
run: __tests__/verify-node.sh 24
version-file-dev-engines:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest]
steps:
- uses: actions/checkout@v6
- name: Setup node from node version file
uses: ./
with:
node-version-file: '__tests__/data/package-dev-engines.json'
- name: Verify node
run: __tests__/verify-node.sh 20
version-file-volta:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
steps:
- uses: actions/checkout@v6
- name: Setup node from node version file
uses: ./
with:
node-version-file: '__tests__/data/package-volta.json'
- name: Verify node
run: __tests__/verify-node.sh 24
version-file-volta-extends:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
steps:
- uses: actions/checkout@v6
- name: Setup node from node version file
uses: ./
with:
node-version-file: '__tests__/data/package-volta-extends.json'
- name: Verify node
run: __tests__/verify-node.sh 24
node-dist:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [21, 23]
steps:
- uses: actions/checkout@v6
- name: Setup Node from dist
uses: ./
with:
node-version: ${{ matrix.node-version }}
- name: Verify node and npm
run: __tests__/verify-node.sh "${{ matrix.node-version }}"
shell: bash
old-versions:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest-large]
steps:
- uses: actions/checkout@v6
# test old versions which didn't have npm and layout different
- name: Setup node 0.12.18 from dist
uses: ./
with:
node-version: 0.12.18
- name: Verify node
run: __tests__/verify-node.sh 0.12.18 SKIP_NPM
shell: bash
arch:
runs-on: windows-latest
steps:
- uses: actions/checkout@v6
- name: Setup node 20 x86 from dist
uses: ./
with:
node-version: '20'
architecture: 'x86'
- name: Verify node
run: __tests__/verify-arch.sh "ia32"
shell: bash
node-latest-aliases:
runs-on: ${{ matrix.os }}
strategy:
fail-fast: false
matrix:
os: [ubuntu-latest, windows-latest, macos-latest, macos-latest-large]
node-version: [current, latest, node]
steps:
- name: Get node version
run: |
latestNodeVersion=$(curl https://nodejs.org/dist/index.json | jq -r '. [0].version')
echo "LATEST_NODE_VERSION=$latestNodeVersion" >> $GITHUB_OUTPUT
id: version
shell: bash
- uses: actions/checkout@v6
- name: Setup Node
uses: ./
with:
node-version: ${{ matrix.node-version }}
- name: Retrieve version after install
run: |
updatedVersion=$(echo $(node --version))
echo "NODE_VERSION_UPDATED=$updatedVersion" >> $GITHUB_OUTPUT
id: updatedVersion
shell: bash
- name: Compare versions
if: ${{ steps.version.outputs.LATEST_NODE_VERSION != steps.updatedVersion.outputs.NODE_VERSION_UPDATED}}
run: |
echo "Latest node version failed to download."
exit 1
+1
View File
@@ -249,6 +249,7 @@ If the runner is not able to access github.com, any Nodejs versions requested du
- [Publishing to npmjs and GPR with npm](docs/advanced-usage.md#publish-to-npmjs-and-gpr-with-npm)
- [Publishing to npmjs and GPR with yarn](docs/advanced-usage.md#publish-to-npmjs-and-gpr-with-yarn)
- [Using private packages](docs/advanced-usage.md#use-private-packages)
- [Publishing to npm with Trusted Publisher (OIDC)](docs/advanced-usage.md#publishing-to-npm-with-trusted-publisher-oidc)
- [Using private mirror](docs/advanced-usage.md#use-private-mirror)
## Recommended permissions
+39
View File
@@ -475,6 +475,45 @@ To access private GitHub Packages within the same organization, go to "Manage Ac
Please refer to the [Ensuring workflow access to your package - Configuring a package's access control and visibility](https://docs.github.com/en/packages/learn-github-packages/configuring-a-packages-access-control-and-visibility#ensuring-workflow-access-to-your-package) for more details.
## Publishing to npm with Trusted Publisher (OIDC)
npm supports Trusted Publishers, enabling packages to be published from GitHub Actions using OpenID Connect (OIDC) instead of long-lived npm tokens. This improves security by replacing static credentials with short-lived tokens, reducing the risk of credential leakage and simplifying authentication in CI/CD workflows.
### Requirements
Trusted publishing requires a compatible npm version:
* **npm ≥ 11.5.1 (required)**
* **Node.js 24 or newer (recommended)** — includes a compatible npm version by default
> If npm is below 11.5.1, publishing will fail even if OIDC permissions are correctly configured.
You must also configure a **Trusted Publisher** in npm for your package/scope that matches your GitHub repository and workflow (and optional environment, if used).
### Example workflow
```yaml
permissions:
contents: read
id-token: write # Required for OIDC
steps:
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
with:
node-version: '24'
registry-url: 'https://registry.npmjs.org'
- run: npm ci
- run: npm run build --if-present
- run: npm publish
```
> **Note**: If the Trusted Publisher configuration (GitHub owner/repo/workflow file, and optional environment) does not match the workflow run identity exactly, publishing may fail with **E404 Not Found** even if the package exists on npm.
For more details, see the [npm Trusted Publishers documentation](https://docs.npmjs.com/trusted-publishers) and the [GitHub Actions OpenID Connect (OIDC) overview](https://docs.github.com/en/actions/concepts/security/openid-connect).
## Use private mirror
It is possible to use a private mirror hosting Node.js binaries. This mirror must be a full mirror of the official Node.js distribution.