| registry | Target package registry (npm, github, or both) | no | both |
| npm-token | NPM access token (required if registry includes npm) | no | — |
| npm-registry-url | NPM registry URL | no | https://registry.npmjs.org |
| github-token | GitHub token for GitHub Packages | no | ${{ github.token }} |
| github-registry-url | GitHub Packages registry URL | no | https://npm.pkg.github.com |
| package-scope | Package scope for GitHub Packages (e.g., @myorg). If not provided and package is unscoped, automatically uses repository owner | no | — |
| main-branch | Name of main/production branch | no | main |
| dev-branch | Name of development branch | no | dev |
| package-path | Path to package.json. Relative paths are resolved from the workflow workspace, and repository contents are checked out automatically when needed. | no | ./package.json |
| build-script | NPM script to run before publishing | no | build |
| package-manager | Package manager to use: npm, yarn, pnpm, bun, or auto (auto-detects from lockfile) | no | auto |
| version-prefix | Prefix for version tags | no | "" |
| audit-enabled | Enable package-manager-aware security scanning (npm audit or bun audit) | no | true |
| audit-level | Minimum severity level for package-manager-aware security scanning | no | high |
| fail-on-audit | Fail build if vulnerabilities found | no | false |
| pr-comment-enabled | Enable PR comments with installation instructions | no | true |
| pr-comment-template | Custom PR comment template | no | — |
| publish-enabled | Enable publishing to registry | no | true |
| dry-run | Perform dry run without publishing | no | false |
| access | Package access level for scoped packages: public or restricted | no | public |
| monorepo | Enable monorepo mode | no | false |
| package-paths | Comma-separated list of package.json paths (monorepo mode). Relative paths are resolved from the workflow workspace. | no | "" |
| workspace-detection | Auto-detect workspaces from root package.json | no | true |
| changed-only | Only build/publish packages that changed relative to the event-specific git diff base (monorepo mode only) | no | true |
| dependency-order | Build packages in dependency order (topological sort) when workspace metadata is available (requires workspace-detection enabled with discovered packages); has no effect when using explicit package-paths without workspace discovery | no | true |
| commit-convention-enabled | Enable smart build filtering based on commit message conventions. When enabled, only commits with build-relevant types (e.g., new, fix, update) trigger builds. Commits like docs or test changes are skipped. | no | false |
| commit-convention | Commit message convention to parse. Affects default trigger/skip type lists when not explicitly overridden. clean-commit uses types like new, update, setup; conventional uses feat, fix, perf, etc. | no | clean-commit |
| build-trigger-types | Comma-separated commit types that trigger a package build. If a type appears in both trigger and skip lists, skip takes priority. Leave empty to use convention-aware defaults. | no | "" |
| build-skip-types | Comma-separated commit types that skip the package build. Skip list is checked before trigger list, so skip takes priority if a type appears in both. Leave empty to use convention-aware defaults. | no | "" |
| bot-detection | Auto-detect bot actors (e.g., dependabot[bot], renovate[bot]) and gracefully fall back to validation-only mode (build and audit still run, publish is skipped). Prevents CI failures from missing secrets on bot-generated PRs. | no | true |