GitHub Actions npm 403: Registry, OIDC and Package Rights

by

For a 403 from npm publish, first identify the registry and package scope. OIDC trusted publishing on npmjs.com and GITHUB_TOKEN authentication to GitHub Packages are different paths. Adding permissions: write-all does not distinguish the cause.

node --version
npm --version
npm config get registry
npm pkg get name version publishConfig

Also check whether scope-specific registry configuration or publishConfig overrides the default. Do not print the entire .npmrc or tokens. ENEEDAUTH does not establish a file-encoding problem; start by identifying the registry and intended authentication method.

Conditions for the npmjs.com OIDC path

The npm trusted-publishing documentation, checked on 2026-09-21, requires npm CLI 11.5.1 or later, Node 22.14.0 or later and a GitHub-hosted runner for this path. The job needs id-token: write, and owner, repository, workflow filename and optional environment registered for the package must match the run. Success from another workflow in the same repository does not establish this match.

GitHub Packages changes the permission question

Inspect package access and workflow association in the GitHub npm-registry documentation. Compare packages: write for a GITHUB_TOKEN publishing job with the target package’s access relationship. An npmjs.com trusted-publisher registration or id-token permission alone does not grant GitHub Packages write access.

Keep validation separate from successful publication

Once version, registry and authentication path match, narrow the response-specific conditions, including an already-published version and package ownership. npm publish –dry-run helps inspect package contents but does not prove OIDC exchange or registry write authorization. Some lifecycle scripts may run, so use it only in a reviewed repository.

Final verification uses the authorized release job’s actual result and the package/version appearing in the intended registry. No package was published and no permission was changed for this article. Documentation checks are not presented as a successful OIDC publishing experiment.