Plugin: publisher-npm

Publishes JavaScript and TypeScript packages to the npm registry (or any compatible registry) after semrel has updated package.json. Automatically detects pnpm, Yarn Berry, Yarn Classic, or npm from your lockfiles.

Installation

Binary

semrel plugin install @semrel/publisher-npm

semrel plugin install downloads the binary to .semrel/plugins/ and updates .semrel.lock. Commit .semrel.lock to pin the version for your team.

Docker

Pre-built, signed multi-platform images (linux/amd64, linux/arm64) are published on every release:

docker pull ghcr.io/semrels/publisher-npm:latest

Verify the image signature with cosign:

cosign verify ghcr.io/semrels/publisher-npm:latest \
  --certificate-identity-regexp 'https://github.com/SemRels/publisher-npm/.github/workflows/release.yml.*' \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

Configuration

version: 1
plugins:
  - uses: @semrel/updater-npm
    phase: pre-tag
    args:
      update_lockfile: "true"

  - uses: @semrel/publisher-npm
    phase: release
    args:
      npm_token: '${env.NPM_TOKEN}'
      npm_tag: latest
      npm_provenance: "true"
      npm_access: public

Environment Variables

Name	Required	Default	Description
`SEMREL_PLUGIN_NPM_TOKEN`	yes (unless dry-run)	`—`	npm auth token passed to the package manager as `NODE_AUTH_TOKEN`.
`SEMREL_PLUGIN_NPM_TAG`	no	`latest`	Dist-tag passed as `--tag <value>`.
`SEMREL_PLUGIN_NPM_PROVENANCE`	no	`false`	When `true`, appends `--provenance` to generate npm provenance attestations.
`SEMREL_PLUGIN_NPM_ACCESS`	no	`—`	When set to `public` or `restricted`, appends `--access <value>` (useful for scoped packages).

Release Context Variables

SEMREL_VERSION
SEMREL_NEXT_VERSION
SEMREL_DRY_RUN

Package Manager Detection

publisher-npm inspects the working directory in this order:

pnpm-lock.yaml → pnpm publish
yarn.lock + .yarnrc.yml (or yarn --version >= 2) → yarn npm publish
yarn.lock → yarn publish
Default → npm publish

When SEMREL_DRY_RUN=true, the plugin logs the resolved package name, version, and exact publish command without invoking the registry upload.

Source

SemRels/publisher-npm