{"_id":"@azu/simple-npm-staged-publish-package-example","_rev":"8-b7ecc4dc8213a226162a2b95a4d87b9b","name":"@azu/simple-npm-staged-publish-package-example","dist-tags":{"latest":"3.1.16"},"versions":{"0.0.1":{"name":"@azu/simple-npm-staged-publish-package-example","version":"0.0.1","keywords":["oidc","trusted-publishing","setup"],"_id":"@azu/simple-npm-staged-publish-package-example@0.0.1","maintainers":[{"name":"azu","email":"azuciao@gmail.com"}],"dist":{"shasum":"04c7df4b771ecc2df9591e02f833f2652ebddb76","tarball":"https://registry.npmjs.org/@azu/simple-npm-staged-publish-package-example/-/simple-npm-staged-publish-package-example-0.0.1.tgz","fileCount":2,"integrity":"sha512-6WCEJ0oBNs0Whv260IB+CddBgOCIt3UyiqJZ76/TulAuUStSYEbZ22oUjFLvg+hqpeDV41fklJaZI9yIx5L+XQ==","signatures":[{"sig":"MEUCIDc1ezYconOnBFfCQzh1jvWaJmp6MFLUFejNp/RJbO5BAiEA1LhYNCV7qW/nG6scwbewlPRDgscZdFw4BZx5Y6EHH0Y=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"unpackedSize":2147},"_npmUser":{"name":"azu","email":"azuciao@gmail.com"},"_npmVersion":"11.15.0","description":"OIDC trusted publishing setup package for @azu/simple-npm-staged-publish-package-example","directories":{},"_nodeVersion":"24.12.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/simple-npm-staged-publish-package-example_0.0.1_1779706894731_0.8510370054661218","host":"s3://npm-registry-packages-npm-production"}},"3.1.9":{"name":"@azu/simple-npm-staged-publish-package-example","version":"3.1.9","author":{"name":"azu","email":"azuciao@gmail.com"},"license":"MIT","_id":"@azu/simple-npm-staged-publish-package-example@3.1.9","maintainers":[{"name":"azu","email":"azuciao@gmail.com"}],"homepage":"https://github.com/azu/simple-npm-staged-publish-package-example#readme","bugs":{"url":"https://github.com/azu/simple-npm-staged-publish-package-example/issues"},"dist":{"shasum":"88b6f3080287854fec83838ff3bfd81a7ae7b137","tarball":"https://registry.npmjs.org/@azu/simple-npm-staged-publish-package-example/-/simple-npm-staged-publish-package-example-3.1.9.tgz","integrity":"sha512-POVwe5nGphPjGlCBlW6C+7+AUU/YqDIuPMuULJpyoIaEvUcm5u0CMelX7jYK9JnmFkEeRDWfvkOBNMYmrSEZPQ==","signatures":[{"sig":"MEUCIBpq7rtMr9Zimjp0avUzoIRxjnewUiD5DlPWAFhQHIvWAiEA1adht27Qg7ARfuyCRN7T0knrIhP4IYb0z5PgjQa//2Q=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@azu%2fsimple-npm-staged-publish-package-example@3.1.9","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}}},"main":"index.js","gitHead":"7adee14a5583aba00b0fe8a9f724dd9a8b1ce203","scripts":{},"_npmUser":{"name":"azu","email":"azuciao@gmail.com"},"repository":{"url":"git+https://github.com/azu/simple-npm-staged-publish-package-example.git","type":"git"},"_npmVersion":"11.15.0","description":"An OIDC example","directories":{},"_nodeVersion":"24.15.0","_npmOperationalInternal":{"tmp":"tmp/simple-npm-staged-publish-package-example_3.1.9_1779709096780_0.9773361519865866","host":"s3://npm-registry-packages-npm-production"}},"3.1.11":{"name":"@azu/simple-npm-staged-publish-package-example","version":"3.1.11","author":{"name":"azu","email":"azuciao@gmail.com"},"license":"MIT","_id":"@azu/simple-npm-staged-publish-package-example@3.1.11","maintainers":[{"name":"azu","email":"azuciao@gmail.com"}],"homepage":"https://github.com/azu/simple-npm-staged-publish-package-example#readme","bugs":{"url":"https://github.com/azu/simple-npm-staged-publish-package-example/issues"},"dist":{"shasum":"368238c7b65e64162062e8c0ab33e062956f88d2","tarball":"https://registry.npmjs.org/@azu/simple-npm-staged-publish-package-example/-/simple-npm-staged-publish-package-example-3.1.11.tgz","integrity":"sha512-3uAnlWYhAA9IYbUYU+8PVy3lVza2yLuOPzyWS673jVCf0nhd/ZwGk+54x/1nXl3bnqtanYfJI766wbCuLqTXvQ==","signatures":[{"sig":"MEYCIQDy0IoYCfA9RZcMYzIDDnXwnn2bluHYhKgVWLrOW0dpwQIhAN/e3zTdgmuztuaAKmwvg3wqR0vMP/ouPC9FUxfHeSZd","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@azu%2fsimple-npm-staged-publish-package-example@3.1.11","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}}},"main":"index.js","gitHead":"8685aac773f1b28d0cdc9ba4c3c506d456285e2c","scripts":{},"_npmUser":{"name":"azu","email":"azuciao@gmail.com"},"repository":{"url":"git+https://github.com/azu/simple-npm-staged-publish-package-example.git","type":"git"},"_npmVersion":"11.15.0","description":"An OIDC example","directories":{},"_nodeVersion":"24.15.0","_npmOperationalInternal":{"tmp":"tmp/simple-npm-staged-publish-package-example_3.1.11_1779709808923_0.7609939533508907","host":"s3://npm-registry-packages-npm-production"}},"3.1.13":{"name":"@azu/simple-npm-staged-publish-package-example","version":"3.1.13","author":{"name":"azu","email":"azuciao@gmail.com"},"license":"MIT","_id":"@azu/simple-npm-staged-publish-package-example@3.1.13","maintainers":[{"name":"azu","email":"azuciao@gmail.com"}],"homepage":"https://github.com/azu/simple-npm-staged-publish-package-example#readme","bugs":{"url":"https://github.com/azu/simple-npm-staged-publish-package-example/issues"},"dist":{"shasum":"64fdfa5467a1167921ac10499a91628cb5a556ad","tarball":"https://registry.npmjs.org/@azu/simple-npm-staged-publish-package-example/-/simple-npm-staged-publish-package-example-3.1.13.tgz","integrity":"sha512-not+11KJkHbLcNbK88vC+FhmUiJq2kqU3rse7hBnUwJfRtu0rAATStnKfApBqIWosgkvmQCuylCX4F4yjr0RYw==","signatures":[{"sig":"MEQCIC7lhGEiS6w9fAwYevaWhhJ2Ee/tx/6l6TOWLE4liRd+AiBZxSdIp5nBMhzYt692LQMKZcmLswHgJjatJjZKKbhBpg==","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@azu%2fsimple-npm-staged-publish-package-example@3.1.13","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}}},"main":"index.js","gitHead":"ffe83ac7c9a029c9c384cab28b5f0c19c27e2fad","scripts":{},"_npmUser":{"name":"azu","email":"azuciao@gmail.com"},"repository":{"url":"git+https://github.com/azu/simple-npm-staged-publish-package-example.git","type":"git"},"_npmVersion":"11.15.0","description":"An OIDC example","directories":{},"_nodeVersion":"24.15.0","_npmOperationalInternal":{"tmp":"tmp/simple-npm-staged-publish-package-example_3.1.13_1779712603346_0.8525378472068008","host":"s3://npm-registry-packages-npm-production"}},"3.1.12":{"name":"@azu/simple-npm-staged-publish-package-example","version":"3.1.12","author":{"name":"azu","email":"azuciao@gmail.com"},"license":"MIT","_id":"@azu/simple-npm-staged-publish-package-example@3.1.12","maintainers":[{"name":"azu","email":"azuciao@gmail.com"}],"homepage":"https://github.com/azu/simple-npm-staged-publish-package-example#readme","bugs":{"url":"https://github.com/azu/simple-npm-staged-publish-package-example/issues"},"dist":{"shasum":"b0622e6f53accec583ade342b4a8ab5b2af54f3e","tarball":"https://registry.npmjs.org/@azu/simple-npm-staged-publish-package-example/-/simple-npm-staged-publish-package-example-3.1.12.tgz","integrity":"sha512-lpoHdZrIb9bGRkkg6kmkXOag4yEMrrCqmX8DPq1u5vjpoDh00y0mn8uQvY/tlYwniaeXUAoXQVphOKmaztxJ4A==","signatures":[{"sig":"MEUCIEovScR6zJf6pPCUUO9c5J+L+emi2FsJIjqcNoPUhecQAiEAt8Slbxq5H5RWS0itzyRsXZBsGNz47BEBlO3t5zqJYI4=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@azu%2fsimple-npm-staged-publish-package-example@3.1.12","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}}},"main":"index.js","gitHead":"5787f2aeded93efa2adc4485791bf810af932696","scripts":{},"_npmUser":{"name":"azu","email":"azuciao@gmail.com"},"repository":{"url":"git+https://github.com/azu/simple-npm-staged-publish-package-example.git","type":"git"},"_npmVersion":"11.15.0","description":"An OIDC example","directories":{},"_nodeVersion":"24.15.0","_npmOperationalInternal":{"tmp":"tmp/simple-npm-staged-publish-package-example_3.1.12_1779712610223_0.9673074215844888","host":"s3://npm-registry-packages-npm-production"}},"3.1.14":{"name":"@azu/simple-npm-staged-publish-package-example","version":"3.1.14","author":{"name":"azu","email":"azuciao@gmail.com"},"license":"MIT","_id":"@azu/simple-npm-staged-publish-package-example@3.1.14","maintainers":[{"name":"azu","email":"azuciao@gmail.com"}],"homepage":"https://github.com/azu/simple-npm-staged-publish-package-example#readme","bugs":{"url":"https://github.com/azu/simple-npm-staged-publish-package-example/issues"},"dist":{"shasum":"4d833b8a32176d00dfc3e1f41a2ca2282ed2e563","tarball":"https://registry.npmjs.org/@azu/simple-npm-staged-publish-package-example/-/simple-npm-staged-publish-package-example-3.1.14.tgz","fileCount":7,"integrity":"sha512-ICbwf6pFMb7oEdaNBdkbv9jM3vwYcM7vJFwq47n4j1EmYpDWpFMs80TUCqN38bPIZFBjCKYRhIen5rcnDng/dQ==","signatures":[{"sig":"MEUCIDHQPB1TkpTKvSQZetRytwgNWwCO7KxzUSGJlP0Zis+9AiEA+s6UHcjwBZVLO81yCRw5T6JNI1MmRsLB30mBwErCHeU=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@azu%2fsimple-npm-staged-publish-package-example@3.1.14","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":15291},"main":"index.js","gitHead":"a1a763dc11c1d4b86dce5640671b41fbb0650f05","scripts":{},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","approver":{"name":"azu","email":"azuciao@gmail.com"},"trustedPublisher":{"id":"github","oidcConfigId":"oidc:950c78fb-b1bd-437f-bb1c-902897281ff5"}},"repository":{"url":"git+https://github.com/azu/simple-npm-staged-publish-package-example.git","type":"git"},"_npmVersion":"11.15.0","description":"An OIDC example","directories":{},"_nodeVersion":"24.16.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/simple-npm-staged-publish-package-example_3.1.14_1781012786276_0.9324724930630977","host":"s3://npm-registry-packages-npm-production"}},"3.1.15":{"name":"@azu/simple-npm-staged-publish-package-example","version":"3.1.15","author":{"name":"azu","email":"azuciao@gmail.com"},"license":"MIT","_id":"@azu/simple-npm-staged-publish-package-example@3.1.15","maintainers":[{"name":"azu","email":"azuciao@gmail.com"}],"homepage":"https://github.com/azu/simple-npm-staged-publish-package-example#readme","bugs":{"url":"https://github.com/azu/simple-npm-staged-publish-package-example/issues"},"dist":{"shasum":"035f14993fd42f6d2f6cf2536242d4d3eb4022b5","tarball":"https://registry.npmjs.org/@azu/simple-npm-staged-publish-package-example/-/simple-npm-staged-publish-package-example-3.1.15.tgz","fileCount":7,"integrity":"sha512-hBa5RDbJYIXV8mbySOwo0PC8wOlnhsN1APEcV1J7o71Pa6Jcf5Jg7y2StMmQoKxT+9xzcpTv17D/fKsr6f4JgQ==","signatures":[{"sig":"MEUCIQDWuxyp9yBMMzWctczlIacYX9P1hQWwwPRHUNUcCOOyewIgbAcs9hqvmv9FkyozW8TEZuI6VfBlCRIEvuLH2Bqcngg=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@azu%2fsimple-npm-staged-publish-package-example@3.1.15","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"unpackedSize":15291},"main":"index.js","gitHead":"21c0d1253992007666c7a928fb9c8a9f3a72fb4e","scripts":{},"_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","approver":{"name":"azu","email":"azuciao@gmail.com"},"trustedPublisher":{"id":"github","oidcConfigId":"oidc:950c78fb-b1bd-437f-bb1c-902897281ff5"}},"repository":{"url":"git+https://github.com/azu/simple-npm-staged-publish-package-example.git","type":"git"},"_npmVersion":"11.15.0","description":"An OIDC example","directories":{},"_nodeVersion":"24.16.0","_hasShrinkwrap":false,"_npmOperationalInternal":{"tmp":"tmp/simple-npm-staged-publish-package-example_3.1.15_1781852765874_0.30403565462609383","host":"s3://npm-registry-packages-npm-production"}},"3.1.16":{"_id":"@azu/simple-npm-staged-publish-package-example@3.1.16","bugs":{"url":"https://github.com/azu/simple-npm-staged-publish-package-example/issues"},"dist":{"shasum":"611e3470a084120b383a931a429faada44b74089","tarball":"https://registry.npmjs.org/@azu/simple-npm-staged-publish-package-example/-/simple-npm-staged-publish-package-example-3.1.16.tgz","integrity":"sha512-m63xUzXWkIJFWaW8cVwmHZE9B1i5TAKC1QwSLCODpEUY81j88YOcEZ8mO0SoTCNnrZZwGlvRFDgTKeLhtCdKxg==","fileCount":7,"unpackedSize":15291,"attestations":{"url":"https://registry.npmjs.org/-/npm/v1/attestations/@azu%2fsimple-npm-staged-publish-package-example@3.1.16","provenance":{"predicateType":"https://slsa.dev/provenance/v1"}},"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIQDzY3PBLaPz1IjwKRIxojcDC+CMACDXNp3/uJNH4K7qKAIgYBm6BcuLyPgQ8dvWL/7YwsUSsEf2Rb0cfUlY5TI4+90="}]},"main":"index.js","name":"@azu/simple-npm-staged-publish-package-example","author":{"name":"azu","email":"azuciao@gmail.com"},"gitHead":"bc07f8035352a6962c87badc49ab8122f5fafdb2","license":"MIT","scripts":{},"version":"3.1.16","_npmUser":{"name":"GitHub Actions","email":"npm-oidc-no-reply@github.com","trustedPublisher":{"id":"github","oidcConfigId":"oidc:950c78fb-b1bd-437f-bb1c-902897281ff5"},"approver":{"name":"azu","email":"azuciao@gmail.com"}},"homepage":"https://github.com/azu/simple-npm-staged-publish-package-example#readme","repository":{"url":"git+https://github.com/azu/simple-npm-staged-publish-package-example.git","type":"git"},"_npmVersion":"11.15.0","description":"An OIDC example","directories":{},"maintainers":[{"name":"azu","email":"azuciao@gmail.com"}],"_nodeVersion":"24.16.0","_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/simple-npm-staged-publish-package-example_3.1.16_1782208653513_0.29234240821158375"},"_hasShrinkwrap":false}},"time":{"created":"2026-05-25T11:01:34.507Z","modified":"2026-06-23T09:57:33.842Z","0.0.1":"2026-05-25T11:01:34.888Z","3.1.9":"2026-05-25T11:38:16.854Z","3.1.11":"2026-05-25T11:50:09.017Z","3.1.13":"2026-05-25T12:36:43.418Z","3.1.12":"2026-05-25T12:36:50.335Z","3.1.14":"2026-06-09T13:46:26.377Z","3.1.15":"2026-06-19T07:06:05.961Z","3.1.16":"2026-06-23T09:57:33.594Z"},"bugs":{"url":"https://github.com/azu/simple-npm-staged-publish-package-example/issues"},"author":{"name":"azu","email":"azuciao@gmail.com"},"license":"MIT","homepage":"https://github.com/azu/simple-npm-staged-publish-package-example#readme","repository":{"url":"git+https://github.com/azu/simple-npm-staged-publish-package-example.git","type":"git"},"description":"An OIDC example","maintainers":[{"name":"azu","email":"azuciao@gmail.com"}],"readme":"# simple-npm-staged-publish-package-example\n\nA minimal example demonstrating npm **Staged Publishing** with GitHub Actions OIDC Trusted Publishers.\n\n## Overview\n\nThis package shows a token-less release flow that requires two human approvals before a version becomes public on npm.\n\n- GitHub Environment protection rule gates the publish workflow\n- npm staged publish approval gates the actual promotion to the public registry\n- No npm tokens are stored — authentication uses GitHub Actions OIDC\n- Provenance attestation is generated automatically\n\n## Release flow\n\n```mermaid\nflowchart TD\n    A[1. Create release PR] --> B[2. Review & merge release PR]\n    B --> C[3. Approve GitHub Environment review]\n    C --> D[4. release.yml runs]\n    D --> E[5. npm publish with OIDC + provenance]\n    E --> F[6. Tarball enters npm staged area]\n    F --> G[7. Approve staged publish on npmjs.com]\n    G --> H[8. Version becomes public]\n```\n\n| Step | Where | Actor | Description |\n| --- | --- | --- | --- |\n| 1 | GitHub Actions | maintainer | Run `create-release-pr.yml` to open a version-bump PR with the `Type: Release` label |\n| 2 | GitHub PR | reviewer | Review and merge the release PR |\n| 3 | GitHub Environment `npm` | reviewer | Approve the deployment to allow the workflow to start |\n| 4 | GitHub Actions | — | `release.yml` runs on the merged PR |\n| 5 | npm registry | — | `npm publish` runs with OIDC authentication and provenance |\n| 6 | npm registry | — | Tarball is staged (not yet visible to consumers) |\n| 7 | npm web UI | maintainer | Approve the staged publish on npmjs.com |\n| 8 | npm registry | — | Version is promoted and installable |\n\n## Workflows\n\n### `create-release-pr.yml`\n\nOpens a release PR. Triggered manually with a version-bump type (`patch` / `minor` / `major`). Generates release notes and applies the `Type: Release` label.\n\n### `release.yml`\n\nPublishes to npm when a PR labeled `Type: Release` is merged. Uses `environment: npm` (gated by required reviewers) and `id-token: write` (for OIDC).\n\n## Setup\n\n### 1. npm Trusted Publisher\n\nGo to your npm package's Settings → Trusted Publisher and register GitHub Actions with:\n\n| Field | Value |\n| --- | --- |\n| Organization / user | Your GitHub user or org |\n| Repository | This repository's name (must match exactly) |\n| Workflow filename | `release.yml` |\n| Environment name | `npm` |\n\nThe OIDC token's `repository`, `workflow`, and `environment` claims are checked against these values. A mismatch causes `E401 Unable to authenticate`.\n\n### 2. `package.json` repository URL\n\n`repository.url` in `package.json` must point to the same repository registered with the Trusted Publisher. If it diverges, provenance verification fails with:\n\n```\nE422 Failed to validate repository information\n```\n\n### 3. GitHub Environment\n\nCreate an environment named `npm` (Settings → Environments → New environment) and add required reviewers. This is what gates step 3 of the release flow.\n\n### 4. Repository settings\n\n- Settings → Actions → General → enable **Allow GitHub Actions to create and approve pull requests**\n- Create a label named `Type: Release`\n\n## Requirements\n\n- npm CLI ≥ 11.5.1 (OIDC and staged publish support)\n- GitHub-hosted runner (self-hosted runners are not supported for provenance)\n- Public repository (provenance is not generated for private repos)\n\n## Troubleshooting\n\n| Error | Cause | Fix |\n| --- | --- | --- |\n| `E401 Unable to authenticate` | Trusted Publisher repo/workflow/environment does not match the OIDC token claims | Align npm Trusted Publisher settings with the actual workflow location |\n| `E422 Failed to validate repository information` | `package.json`'s `repository.url` does not match the provenance source | Update `repository.url` to point to the actual repository |\n| Workflow does not start after merge | GitHub Environment is awaiting approval | Approve the deployment under the PR's checks or the Actions run page |\n\n## Links\n\n- [npm Trusted Publishing](https://docs.npmjs.com/trusted-publishers)\n- [npm Staged Publish](https://docs.npmjs.com/cli/commands/npm-publish#staged-publishes)\n- [GitHub OIDC](https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect)\n- [Package on npm](https://www.npmjs.com/package/@azu/simple-npm-staged-publish-package-example)\n\n## License\n\nMIT\n","readmeFilename":"README.md"}