GitHub npm Ops

Create a granular npm access token with bypass-2FA enabled, store it as the NPM_TOKEN secret, and run npm publish --provenance --access public in a tag-triggered workflow with id-token: write permission. The package.json repository.url must match the GitHub repository.

First check whether npm received the tarball with npm view <pkg> version. If not uploaded, delete the local and remote tag, fix the root cause such as an expired token, and re-push the same tag. If already uploaded, never re-publish the same version; bump to the next patch version instead.

E403 occurs when using a classic token or a granular token without the bypass-2FA option. Generate a new Granular Access Token with read-and-write permission on the target scope and bypass two-factor authentication enabled, then update the GitHub secret.

The release action's generate_release_notes option relies on PR titles and labels, so repositories that push directly to main get only a compare link. Extract the version section from CHANGELOG.md with awk and inject it via the body_path input of softprops/action-gh-release.

No. npm permanently blocks re-publishing the same version even after unpublish within the 24-hour window. You must bump to a new version number and record the superseded release in the CHANGELOG.

Re-run the failed job on the same commit with gh run rerun --failed; two consecutive failures indicate a real bug. Environment-related errors like DNS timeouts or external service 500s typically signal flakiness, which should be tracked with a flaky-test label rather than silently retried.