Repository navigation
Use trusted publishing for NPM packages #2474
Description
The use of access tokens for publishing to npmjs is no longer recommended.
Instead the trusted publishing for NPM packages should be used, see:
https://docs.npmjs.com/trusted-publishers
To get this working we would need to adapt the GHA workflow and configure publishing on each package on npmjs.
To get everyone to migrate from using access tokens and use trusted publishing instead, access tokens nowadays expire after max 90 days.
Activity
MartinaeyNL commentedon Jan 29, 2026
Interesting to take into count when working on #2040
wborn commentedon Jul 21, 2026
GitHub/npm have announced that tokens bypassing 2FA will no longer be able to publish packages from around January 2027. The earlier August 2026 change should not affect publishing.
So there is no immediate impact, but the workflow should be migrated to npm trusted publishing before the end of 2026.
See also: https://github.blog/changelog/2026-07-08-npm-install-time-security-and-gat-bypass2fa-deprecation/
wborn commentedon Aug 4, 2026
It would probably save some rework to first rename the repository as tracked in #3151 and decide whether the UI code and npm packages should remain in this repository or move elsewhere.
The npm trusted publisher configuration identifies the GitHub repository and workflow filename, while the package repository metadata must also match the publishing repository. Configuring trusted publishing before these decisions are implemented could therefore mean updating the npm package settings and publishing workflows twice.
Once the final repository name and location of the UI packages are clear, trusted publishing can be configured directly for their intended long-term location.