Skip to main content

npm trusted publishing

Diagnose OIDC permission denied, missing trust records, and first-package limitations.

An npm E403 OIDC permission denied error means the workflow identity does not match a trusted publisher with publish permission.

Check the exact identity

Compare all four values:

  • GitHub repository, such as lupinum-dev/project,
  • workflow file name, which is publish.yml in the standard,
  • GitHub environment, which is npm, and
  • permission, which must allow direct publication.

The file name is part of the identity. A trust record for release.yml does not authorize publish.yml.

List the current record:

bash
npm trust list @lupinum/package-name --json

Revoke an incorrect record by its ID. Create the correct record with npm trust github ... --allow-publish.

Recognize first-package behavior

npm trust github returns E404 when the package does not exist. npm staged publishing also cannot create a new package. Use the documented first npm bootstrap. Configure trust immediately after the exact certified tarball is public.

Check the workflow

The publication job needs id-token: write. It must use the protected npm environment and run from the authorized branch. Do not add NPM_TOKEN as a fallback.

After correction, rerun the release from the same certified artifact when the version was not published. If the version already exists, do not publish it again.