Multiple trusted publishing configurations for npm
We’re continuing to make trusted publishing smoother for npm publishers, guided by maintainers feedback.
Npm packages hosted via GitHub can now have more than one trusted publishing (OIDC) configuration. Maintainers were previously limited to one configuration per package, which meant relying on workflow workarounds or a long-lived token to cover paths OIDC couldn't reach, such as separate stable, prerelease, or staging release flows. Each configuration is independent and additive, with its own repository, workflow, and environment criteria, and can be added, listed, or removed from the package's settings page. A publish or stage is authorized if the incoming token matches any one configuration; GitHub notes that evaluation order isn't guaranteed, so configurations shouldn't be treated as having priority over one another.
Two related changes ship alongside this, detailed in the announcement:
- In the staged publishing queue, the approval button is now disabled until malware scanning finishes, and becomes available once the scan completes. The queue page refreshes status every minute.
- The versions tab on npmjs.com now shows maintainers a detailed history for each version, including whether it was approved, rejected, or is still staged.
