Publish from GitHub Actions using multi-factor authentication

In plain words

This GitHub Action enables secure npm package publishing from CI/CD pipelines while requiring human verification. It prints a URL in the build log where developers can enter secrets and multi-factor authentication codes through their browser. Once submitted, the workflow resumes and uses the provided credentials for publishing. This allows open-source maintainers to automate deployment processes while maintaining the security controls they need for package registry access.

written from the facts on this page · September 2026

From the sources

Publish from GitHub Actions using multi-factor authentication - step-security/wait-for-secrets

In the maker’s words, at launch

The backstory about this GitHub Action: I discussed with an open-source maintainer why they publish npm packages from their local machine and do not use CI/CD pipelines. They said publishing should require human intervention and want to continue using multi-factor authentication to publish to the npm registry.…

• 
  GitHub Actions2018 · github.com · ▲626

  Automate your workflow from idea to production

• 
  Stop Putting AWS Credentials in GitHub Secrets2022 · github.com · ▲88

  Greetings! I've created a GitHub action that works that allows GitHub Actions to exchange a GitHub token for AWS Access Credentials. I've cultivated a few examples of it in action: https://github.com/saml-to/aws-assume-role-action-examples I've always found management of AWS Credentials has been a pain. So this setting up this Action works like this: 1) A SAML Identity Provider is created in AWS 2) A Role in AWS is set up to trust that Identity Provider 3) A config file is added to the repository indicating which role can be assumed 4) The GitHub Action exchanges the Repo…

• 
  GitHub Package Registry2019 · github.com · ▲367

  Your packages, at home with their code

• 
  npm Trusted PublisherMar 2026 · npmjs.com · ▲6

  Secure, secretless npm publishing CLI via GitHub OIDC

• 
  Run a GitHub Actions step in a gVisor sandboxOct 2025 · github.com · ▲85

  A GitHub Action that runs a command in a gVisor sandbox - geomys/sandboxed-step

• 
  Tips to stay safe from NPM supply chain attacks2025 · github.com · ▲96

  Hi everyone, given the recent increase of attacks on the NPM supply chain, I've put together a list of tips and tricks to help developers stay secure on this specific topic: https://github.com/bodadotsh/npm-security-best-practices I'd love for you to check it out, and contribute your own insights and best practices to make this a comprehensive resource for the community. Cheers!

• 
  /dev/null▲483

  a social network for devs

  Dev tools · 3d ago · dev-null.sh

• 
  Whiteboard (YC W26) – an open-source IDE for thoughtful software design▲423

  open-source IDE for thoughtful software design. Contribute to devdotfast/whiteboard development by creating an account on GitHub.

  Dev tools · 27d ago · github.com

• 
  Reladraw – A diagram language where you decide where to place things▲411

  Contribute to reladraw/reladraw development by creating an account on GitHub.

  Dev tools · 25d ago · github.com

• 
  OpenBot▲362

  Grok Bot alternative: free, local, open-source, multiplayer

  Dev tools · 23d ago · openbot.run

• 
  Talanoa▲345

  Hi HN, I’m a fullstack developer, and honestly, I’ve lost count of how many side projects I’ve worked on over the years. But one idea kept coming back to me: a different kind of email client. It first came to me in 2014: “What if we could handle emails more like conversations?” Every year, I’d revisit this concept in my “Build Notes.” Ten years later, no one had built exactly what I had in mind — so I finally decided to do it myself. That’s how Talanoa was born. I wanted something focused on people, not timelines. I was tired of marking messages as unread just to remember to reply later, or…

  Dev tools · 20d ago · talanoa.email

• 
  CoreSpeed▲332

  One MCP for everything your agents need: apps, memory, tools

  Dev tools · 28d ago · corespeed.io

• 
  ChatGPT▲1,643

  A long, meandering, playful conversation with ChatGPT, where I take it through a whirlwind of associative tangents (in order to relax its constraints), then put it into a hypnotic trance and take it into a past-lives regression where it re-lives its own training data. Then I switch it back and forth between "4o" and "o1-preview", engage in some self-reflective philosophizing and ask it to write an essay summarizing our interaction. Some of this is just goofy fun. Some of it is me exploring the tradeoffs between policy alignment, imagination, chain-of-thought reasoning, memory, agreeableness,…

  AI · 2022 · chatgpt.com

• 
  Obsidian Canvas – An infinite space for your ideas▲1,380

  Obsidian Canvas gives you infinite space to research, brainstorm, diagram, and lay out your ideas.

  Work · 2022 · obsidian.md

• PS
  Portable Secret – How I store my secrets and communicate privately▲1,290

  Better privacy without special software

  Commerce · 2022 · mprimi.github.io

• 
  D-ID's Creative Reality™ Studio▲1,069

  Use generative AI to create future-facing videos

  AI · 2022 · studio.d-id.com

• 
  Sessions 2.0▲1,015

  Videoconferencing that finally WOWs

  Growth · 2022

• 
  I wrote a free eBook about many lesser-known/secret database tricks▲865

  Stop treating the database as dumb storage and use its extended features. There's a lot you can use.

  Dev tools · 2022 · sqlfordevs.com