First npm release

npm cannot configure a trusted publisher for a package that does not exist. Staged publishing also cannot create a new package. The first publication is a controlled, interactive bootstrap.

Certify the first tarball

Merge the release candidate to protected main. Run the complete release certification workflow. Download the retained artifact from that exact commit.

Verify the artifact digest and the release manifest. Do not run npm pack again. Do not rebuild the package locally.

Publish the exact tarball

Sign in to npm with the owning human account and two-factor authentication. Publish only the certified file:

npm publish ./certified-package.tgz \
  --access public \
  --tag latest \
  --ignore-scripts

Use --tag next when the first version is a prerelease.

Compare the registry's version, dist-tag, and dist.shasum with the certified manifest. Stop if any value differs.

Configure the trusted publisher

Bind the published package to the exact repository, workflow file, and environment:

npm trust github @lupinum/package-name \
  --repo lupinum-dev/repository-name \
  --file publish.yml \
  --env npm \
  --allow-publish \
  --yes

List the trust record and confirm the repository, publish.yml, npm environment, and publish permission. Repeat this step for every independently published package in a monorepo.

Complete the public record

Create the matching GitHub tag and release from the release commit without republishing or rebuilding. Install the public package in a clean consumer.

The bootstrap version does not have GitHub OIDC provenance. Record this known limitation. Every later version must use the normal trusted workflow.