lfreleng-actions/🚀 Node.js Package Publish
Stamps a version into package.json and publishes the package to an npm registry
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Jul 9, 2026
- License
- None
Pinned Snippet
uses: lfreleng-actions/node-publish-action@edbfa68ff0f9a87924ce4382053398188d1fc335 # v0.0.1tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| publish_version | Version to stamp and publish, such as '1.2.3' or '1.2.3-SNAPSHOT'; characters 0-9 A-Z a-z . - | yes | — |
| registry_url | Target npm registry URL ending with '/'; required unless dry_run is 'true'; characters A-Z a-z 0-9 . : / _ - | no | "" |
| dry_run | Pack and verify without registry interaction ('true'/'false'); skips credential setup | no | false |
| path_prefix | Project directory; must resolve within the workspace | no | . |
| node_version | Node.js version to set up, such as '22', '22.x' or 'lts/*'; characters A-Z a-z 0-9 . * / _ - | no | 22 |
| node_version_file | File containing the Node.js version, such as '.nvmrc'; takes precedence over node_version; must resolve within the workspace | no | "" |
| tag | npm distribution tag; characters A-Z a-z 0-9 . _ - | no | latest |
| access | Package access: 'public', 'restricted' or unset | no | "" |
| provenance | Generate registry-native provenance ('true'/'false'); needs a registry with Sigstore provenance support (npmjs.org) plus OIDC; Nexus lacks support | no | false |
| nexus_user | Registry username (default: calling repository name) | no | "" |
| nexus_password | Registry password/token; required for non-dry-run publishes unless load_credential is 'true' | no | "" |
| load_credential | Fetch the password from 1Password via credential-load-action ('true'/'false') | no | false |
| vault_mapping_json | JSON mapping repository owner to 1Password vault (used when load_credential is 'true') | no | "" |
| op_service_account_token | 1Password service account token (used when load_credential is 'true') | no | "" |
| scope | npm scope for the auth entry (for example '@onap') | no | "" |
Outputs
| name | description |
|---|---|
| published_version | Version stamped into package.json and published |
| package_name | Package name from the publish metadata |
| tarball_name | Tarball filename from the publish metadata |