@regenrek/npm-trustme

---
name: npm-trustme
description: Automate npm Trusted Publisher setup via the npm-trustme CLI. Use when configuring or verifying npm Trusted Publishers for GitHub Actions with npx npm-trustme, including browser automation and WebAuthn passkey approval.
---

# npm-trustme

## Overview

Automate npm Trusted Publisher setup in the npm web UI. Requires a one-time WebAuthn approval in a real browser session (passkey or security key).

## CLI Quick Start

- One-time if browsers are missing: `npx playwright install`
- Ensure (create if missing): `npx npm-trustme ensure --yes ...`
- Check only: `npx npm-trustme check ...`
- Generate workflow: `npx npm-trustme workflow init`
- Doctor: `npx npm-trustme doctor`
- Non-interactive install: `npx npm-trustme install --non-interactive ...`

## Required Target Inputs

- Required: `--package`, `--owner`, `--repo`, `--workflow`
- Optional: `--publishing-access`, `--environment`, `--maintainer`

Default inference:
- package: `package.json#name`
- owner/repo: `git remote origin`
- workflow: `.github/workflows/npm-release.yml` or the only workflow file

## Examples

Check:
```
npx npm-trustme check \
  --package <PACKAGE_NAME> \
  --owner <GITHUB_OWNER> \
  --repo <GITHUB_REPO> \
  --workflow <WORKFLOW_FILE> \
  --publishing-access <PUBLISHING_ACCESS>
```

Ensure (create if missing):
```
npx npm-trustme ensure \
  --package <PACKAGE_NAME> \
  --owner <GITHUB_OWNER> \
  --repo <GITHUB_REPO> \
  --workflow <WORKFLOW_FILE> \
  --publishing-access <PUBLISHING_ACCESS> \
  --yes
```

Non-interactive install (single package):
```
npx npm-trustme install --non-interactive \
  --package <PACKAGE_NAME> \
  --owner <GITHUB_OWNER> \
  --repo <GITHUB_REPO> \
  --workflow <WORKFLOW_FILE> \
  --publishing-access disallow-tokens \
  --headless \
  --storage ~/.npm-trustme/storage.json
```

Non-interactive install (monorepo):
```
npx npm-trustme install --non-interactive \
  --all-packages \
  --owner <GITHUB_OWNER> \
  --repo <GITHUB_REPO> \
  --workflow npm-release.yml \
  --publishing-access disallow-tokens
```

Targets file (JSON/YAML):
```
targets:
  - packageName: my-pkg
    owner: my-org
    repo: my-repo
    workflow: npm-release.yml
    environment: npm
    publishingAccess: disallow-tokens
```

Workflow write in non-interactive install:
```
npx npm-trustme install --non-interactive \
  --workflow-init \
  --workflow-file npm-release.yml \
  --workflow-pm pnpm \
  --workflow-node 24 \
  --workflow-trigger release \
  --workflow-dispatch true \
  --workflow-build-command "pnpm build" \
  --workflow-publish-command "npm publish --access public --provenance"
```

Dedicated Chrome (keeps main browser open):
```
npx npm-trustme chrome start
npx npm-trustme ensure --yes
```

## Notes

- `--env-file` can load a specific `.env` path.
- `--storage` can persist Playwright storage state for faster re-runs.
- Inline cookies (Sweet Cookie format) are supported: `--inline-cookies-json`, `--inline-cookies-base64`, or `--inline-cookies-file`.
- Requires Node >= 22 (Sweet Cookie uses node:sqlite).
- Chrome profile reuse (manual session): `--chrome-profile` / `--chrome-profile-dir` / `--chrome-user-data-dir` / `--chrome-path`.
- Connect to an existing Chrome: `--chrome-cdp-url` or `--chrome-debug-port` (Chrome must be launched with remote debugging).
- Cookie import: `--import-cookies` (default true) to copy npm cookies from your main Chrome profile.
- `npm-trustme ensure` prompts for confirmation; use `--yes` in automated/agent runs.
- `npm-trustme install --non-interactive` requires all target fields; use `--targets-file` for per-package overrides.
- For headless runs, provide `--storage` or inline cookies to avoid interactive login/2FA.