我有一个npm包，我通过GitHub Actions工作流发布。为了保障工具链的安全，我使用Trusted Publishing来进行OIDC认证，而不是使用长期有效的发布令牌。一切看起来都已正确配置。

I have a ./.github/workflows.publish.yml

name: Publish

on:
  push:
    tags:
      - 'v*.*.*'

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 22
          cache: 'npm'
          registry-url: 'https://registry.npmjs.org'
      - run: npm ci
      - run: npm test
      - run: npm run build
      - run: npm publish

然而，我收到一个404错误，提示该版本不在注册表中。

npm notice
npm notice Publishing to https://registry.npmjs.org/ with tag latest and public access
npm error code E404
npm error 404 Not Found - PUT https://registry.npmjs.org/vite-plugin-slow-response - Not found
npm error 404
npm error 404  '[email protected]' is not in this registry.
npm error 404
npm error 404 Note that you can also install from a
npm error 404 tarball, folder, http url, or git url.
npm error A complete log of this run can be found in: /home/runner/.npm/_logs/2026-06-08T00_52_45_213Z-debug-0.log

解决方案

原来Trusted Publishing太新了，以至于当前的Node版本和捆绑的npm还不支持它。需要npm 11.5.1或更高版本。

如果你需要针对较旧的Node版本，比如Node 22，请将

- run: npm publish

改为以下内容，以使用最新的npm

- run: npx npm@latest publish

然而，如果你能够将目标Node版本设为24，则可以将 actions/setup-node 更新为v6，该版本捆绑了足够新的npm。

      - uses: actions/setup-node@v6
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'

有关Trusted Publishing在 GitHub Actions中的更多细节，请参阅这里：here。