DEV Community: tsevdos

Publish your npm package using Changesets and GitHub actions

tsevdos — Tue, 28 Apr 2026 21:00:00 +0000

This article is a follow-up to my previous article, "Getting started with Changesets". If you haven't read it yet, I highly recommend doing so first, as it will give you a better understanding of what Changesets are and how they work. In this article, I'll show you how to publish your npm package using Changesets and GitHub actions — this way, you don't have to worry about manually running the publish command and can focus on writing code and creating new features instead. Keep in mind that you must have initialized your repository with Changesets, so make sure you have already set it up (more details in the "Getting started with Changesets" article) before proceeding with this one.

For the record, at the end of 2025, and after many security issues on the npm registry, the npm team decided to revoke all personal npm tokens to increase security. This, of course, led to many broken pipelines, especially those used for publishing npm packages. This affected my own npm packages, and that's the reason I wrote this guide. In this guide, I'll show you how to automate the publishing of your npm packages using GitHub actions! Let's get started!

Configuring trusted publishing on GitHub actions

Before starting, please make sure you read and understand the "Trusted publishing for npm packages" and the "Npm classic tokens revoked, session-based auth and CLI token management now available" documentation from the NPM and GitHub sites. Now, let's start with the configuration:

The first step is to configure trusted publishing on Github actions (or GitLab CI/CD Pipelines). Visit your npm package page at the npm registry, and click on the "Settings" tab. Then click on "Add a trusted publisher", GitHub Actions in our case, and fill in the following fields:

Organization or user (required): Your GitHub username or organization name
Repository (required): Your repository name
Workflow filename (required): The filename of your workflow (e.g., publish.yml)
- Enter only the filename, not the full path
- Must include the .yml or .yaml extension
- The workflow file must exist in .github/workflows/ in your repository
Environment name (optional): If using GitHub environments for deployment protection

Check out my settings:

Create the GitHub workflow

Once you complete the above configuration, you can create a file at .github/workflows/publish.yml with the following content.

name: Publish

on:
  push:
    branches:
      - main

concurrency: ${{ github.workflow }}-${{ github.ref }}

permissions:
  contents: write
  pull-requests: write
  id-token: write

jobs:
  publish:
    name: Release
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Repo
        uses: actions/checkout@v6

      - name: Setup Node.js 24
        uses: actions/setup-node@v6
        with:
          node-version: 24
          registry-url: "https://registry.npmjs.org"

      - name: Install Dependencies
        run: npm i

      - name: Create Release Pull Request or Publish to npm
        id: changesets
        uses: changesets/action@v1
        with:
          # This expects you to have a script called release which does a build for your packages and calls changeset publish
          publish: npm run release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          NPM_TOKEN: "" # https://github.com/changesets/changesets/issues/1152#issuecomment-3190884868
          NPM_CONFIG_PROVENANCE: true

For some reason, the Changesets action requires the NPM_TOKEN environment variable to be set, even if it's not used (see the Github issue #1152)! Feel free to modify the above workflow to fit your needs. If you need any inspiration, have a look at my workflow.

Now whenever you push to main, Changesets will open a new pull request with the changeset, and once you merge that pull request, the package will be automatically published to npm registry! You can also modify the workflow to publish directly to npm without creating a pull request, but I prefer this approach because it gives us more control over what gets published. You can view an example PR opened from Changesets here. When you merge the PR, the package will be published to npm registry!

Install the Changeset-bot on your Github repository

As a bonus / optional but very convenient step, is to install the Changeset bot from the Github marketplace. This bot will automatically prompt any contributor (even yourself) to create changesets without having to run the npx changeset command locally, letting you do it directly from the GitHub site instead.

That's all! You can finally focus on writing code and creating new features for your package, and let the workflow take care of the publishing process. I hope you found this guide useful and that it will help you automate the publishing of your npm packages using Changesets and GitHub Actions. If you have any questions or suggestions, feel free to leave a comment below or reach out to me on Twitter @tsevdos. Happy coding!

Getting started with Changesets

tsevdos — Mon, 06 Apr 2026 21:00:00 +0000

Changesets is the best way to manage, version, and publish your packages. It works great both on standard repositories and monorepos, it integrates easily with your workflows (more on that in a future post), and most importantly, it makes sense! Below is a quick tutorial on how to set up Changesets and how it works. I'm also planning to write a follow up post on how to automate the publishing process using GitHub actions, so stay tuned for that.

Installation

First things first, you must definitely have a look at the official changesets documentation. Below, I'll show you how to install and use the basics of Changesets. First of all, we need to set up and initialize Changesets in our project.

npx @changesets/cli init

This command will create a .changeset directory in the root of your project, with the following two files:

README.md
config.json

In most cases the defaults are fine, but my config.json file has the following configuration (I'm using GitHub's changelog generator @changesets/changelog-github):

{
  "$schema": "https://unpkg.com/@changesets/config@3.0.0/schema.json",
  "changelog": ["@changesets/changelog-github", { "repo": "tsevdos/elUtils" }],
  "commit": false,
  "fixed": [],
  "linked": [],
  "access": "public",
  "baseBranch": "main",
  "updateInternalDependencies": "patch",
  "ignore": []
}

Creating a Changeset

The next step is to actually create a changeset. Again, have a look at the Changesets official CLI. The core idea of Changesets is that you can create a "changeset file" at any point that describes your changes, such as the addition of a new feature, a bug fix, etc. After committing the changeset, Changesets will handle the versioning and the changelog of your project. Keep in mind that you can create multiple changesets before committing (they stack on top of each other), and you can also create changesets for multiple packages if you are working on a monorepo. Here is how you can create a changeset:

npx changeset

You'll be prompted to describe your changes using the semantic versioning specification (semver) and a description of your change. The output looks like something like this:

🦋  What kind of change is this for repo?
❯ major (breaking change)
  minor (new feature)
  patch (bug fix)

This will create a random file in the .changeset directory (ex. .changeset/brave-garlics-pump.md) with the description and the semver type you chose.

---
"@tsevdos/el-utils": minor
---

new feature added

Versioning and publishing

When you're ready to release a new version of your package and apply the changeset(s) you've created, simply run the following command:

npx @changesets/cli version

The above command will take care two things:

Update the version of the package.json file (ex. "version": "1.12.3")
Update the CHANGELOG.md file to reflect your changes

After that, you can commit and push the changes to your repository and finally publish the package to the npm registry using the following command:

npx @changesets/cli publish

Personally, I prefer to have all these commands available in the scripts section of the package.json file for easier access:

{
  "scripts": {
    "changeset": "npx changeset",
    "version": "npx @changesets/cli version",
    "publish": "npx @changesets/cli publish"
  }
  ...
}

And that’s it for the basics of Changesets! You should now have a solid foundation for managing versioning and releases in your projects. In the next post, we’ll take things a step further and automate the entire process using GitHub actions, so stay tuned.