npm staged publishing now supports creating new packages
The npm staged publishing workflow now allows for the initialization and creation of entirely new packages. This capability is supported via local sessions or granular access tokens, including stage-only tokens.
Verified State Diff
Impact & Verification Analysis
npm package maintainers, DevOps engineers, and automated CI/CD pipeline architects.
It removes the manual bottleneck in package lifecycle management, enabling fully automated, secure, and token-restricted package creation workflows.
Full Fact Overview
Previously, the staged publishing workflow was restricted to updating existing packages, requiring an initial manual publish to establish the package registry entry. By extending this to new packages, GitHub has streamlined the CI/CD pipeline for npm, allowing developers to automate the entire lifecycle of a package from creation to deployment without needing long-lived, high-privilege registry tokens. This integration leverages granular access tokens to enforce the principle of least privilege during the initial package registration process.