js-devtools/NPM Publish

Fast, easy publishing to NPM

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Apr 3, 2026
License: MIT

Pinned Snippet

workflow.ymlSHA-pinned

uses: js-devtools/npm-publish@0fd2f4369c5d6bcfcde6091a7c527d810b9b5c3f # v4.1.5

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
token	The NPM access token to use when publishing	no	—
registry	The NPM registry URL to use	no	—
package	The path to your package or its package.json file	no	—
tag	The distribution tag to publish	no	—
access	Determines whether the published package should be publicly visible, or restricted to members of your NPM organization.	no	—
provenance	Attach provenance statements when publishing.	no	—
strategy	Version check and release strategy. If "all" (default), package will be published if its version is simply not yet published. If "upgrade", package will be published if its version is higher than the existing tag, according to semantic versioning.	no	—
ignore-scripts	Run npm with the --ignore-scripts flag as a security precaution. Enabled by default.	no	—
dry-run	Run npm with the --dry-run flag to avoid actually publishing anything.	no	—

Outputs

name	description
id	The identifier of the published package. If a release was published, format is `${name}@${version}. If no release occurred, will be an empty string.
type	The type of version change that occurred on the published tag. If release was an upgrade, will be a semver release type ("major", "minor", ...). If the published tag had no previous version, will be "initial". If version was change was not an upgrade, will be "different". If no release occurred, will be an empty string.
name	Name of the package.
version	Version of the package.
old-version	The previous version on the distribution tag. If there was no previous version on the tag, will be an empty string.
registry	The registry used for version checking and publishing.
tag	The distribution tag used for version checking and publishing.
access	The package access setting used. If configured by the action or package.json, will be "public" or "protected". If not configured for a non-scoped package, will be "public". If not configured for a scoped package, will be "default".