npm-trustme

Overview

Automate npm Trusted Publisher setup in the npm web UI. Requires a one-time WebAuthn approval in a real browser session (passkey or security key).

CLI Quick Start

• •One-time if browsers are missing: npx playwright install
• •Ensure (create if missing): npx npm-trustme ensure --yes ...
• •Check only: npx npm-trustme check ...
• •Generate workflow: npx npm-trustme workflow init
• •Doctor: npx npm-trustme doctor
• •Non-interactive install: npx npm-trustme install --non-interactive ...

Required Target Inputs

• •Required: --package, --owner, --repo, --workflow
• •Optional: --publishing-access, --environment, --maintainer

Default inference:

• •package: package.json#name
• •owner/repo: git remote origin
• •workflow: .github/workflows/npm-release.yml or the only workflow file

Examples

Check:

npx npm-trustme check \
  --package <PACKAGE_NAME> \
  --owner <GITHUB_OWNER> \
  --repo <GITHUB_REPO> \
  --workflow <WORKFLOW_FILE> \
  --publishing-access <PUBLISHING_ACCESS>

Ensure (create if missing):

npx npm-trustme ensure \
  --package <PACKAGE_NAME> \
  --owner <GITHUB_OWNER> \
  --repo <GITHUB_REPO> \
  --workflow <WORKFLOW_FILE> \
  --publishing-access <PUBLISHING_ACCESS> \
  --yes

Non-interactive install (single package):

npx npm-trustme install --non-interactive \
  --package <PACKAGE_NAME> \
  --owner <GITHUB_OWNER> \
  --repo <GITHUB_REPO> \
  --workflow <WORKFLOW_FILE> \
  --publishing-access disallow-tokens \
  --headless \
  --storage ~/.npm-trustme/storage.json

Non-interactive install (monorepo):

npx npm-trustme install --non-interactive \
  --all-packages \
  --owner <GITHUB_OWNER> \
  --repo <GITHUB_REPO> \
  --workflow npm-release.yml \
  --publishing-access disallow-tokens

Targets file (JSON/YAML):

targets:
  - packageName: my-pkg
    owner: my-org
    repo: my-repo
    workflow: npm-release.yml
    environment: npm
    publishingAccess: disallow-tokens

Workflow write in non-interactive install:

npx npm-trustme install --non-interactive \
  --workflow-init \
  --workflow-file npm-release.yml \
  --workflow-pm pnpm \
  --workflow-node 24 \
  --workflow-trigger release \
  --workflow-dispatch true \
  --workflow-build-command "pnpm build" \
  --workflow-publish-command "npm publish --access public --provenance"

Dedicated Chrome (keeps main browser open):

npx npm-trustme chrome start
npx npm-trustme ensure --yes

Notes

• •--env-file can load a specific .env path.
• •--storage can persist Playwright storage state for faster re-runs.
• •Inline cookies (Sweet Cookie format) are supported: --inline-cookies-json, --inline-cookies-base64, or --inline-cookies-file.
• •Requires Node >= 22 (Sweet Cookie uses node:sqlite).
• •Chrome profile reuse (manual session): --chrome-profile / --chrome-profile-dir / --chrome-user-data-dir / --chrome-path.
• •Connect to an existing Chrome: --chrome-cdp-url or --chrome-debug-port (Chrome must be launched with remote debugging).
• •Cookie import: --import-cookies (default true) to copy npm cookies from your main Chrome profile.
• •npm-trustme ensure prompts for confirmation; use --yes in automated/agent runs.
• •npm-trustme install --non-interactive requires all target fields; use --targets-file for per-package overrides.
• •For headless runs, provide --storage or inline cookies to avoid interactive login/2FA.