Automate npm trusted publishing setup via `npm trust` CLI by Copilot · Pull Request #643 · sanity-io/plugins

Copilot · 2026-03-04T11:15:45Z

npm/cli#8899 shipped npm trust in npm 11.10.0, enabling CLI-based trusted publishing configuration. This replaces the manual npmjs.com web UI steps with a single command:

npm trust github <package> --file=release.yml --repository=sanity-io/plugins

Workflow (`setup-trusted-publish.yml`)

New step echoes the npm trust github CLI command for the user to run locally after the package is created on npm

Generator & templates

turbo/generators/config.ts: Simplified getSetupInstructions() — workflow steps streamlined, with CLI command replacing the 6-step manual web UI flow
README.todo.md.hbs: CLI command is primary instruction; manual web UI preserved in a collapsible <details> block

Documentation

CONTRIBUTING.md: Both "new package" and "existing package" sections updated to lead with CLI command
AGENTS.md: Trusted publishing quick reference updated

Original prompt

Investigate if npm/cli#8899 means we can automatically setup trusted publishing correctly instead of referring to the npm settings listings pages with manual instructions for filling in the form.

If it works, update workflows that currently point to manual steps to either fully automate it or give instructions on what npm version to have, and what command to run.
It's better if the automation can do it and instead only do an npm version check and warn the user need to update npm and what steps to run after, if it's on the right version then simply update it without bugging the user

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

vercel · 2026-03-04T11:15:50Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
plugins-studio	Ready	Preview, Comment	Mar 5, 2026 8:16am

changeset-bot · 2026-03-04T11:15:51Z

⚠️ No Changeset found

Latest commit: 56cedf6

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

Update workflows and documentation to use `npm trust github` (available in npm >= 11.10.0, from npm/cli#8899) instead of requiring manual web UI configuration on npmjs.com. Changes: - setup-trusted-publish.yml: Add OTP input and `npm trust github` step to automatically configure trusted publishing after package creation - turbo/generators/config.ts: Simplify setup instructions with CLI command - README.todo.md.hbs: Replace manual web UI steps with CLI command - CONTRIBUTING.md: Update both new and existing package sections - AGENTS.md: Update trusted publishing quick reference Co-authored-by: stipsan <81981+stipsan@users.noreply.github.com>

.github/workflows/setup-trusted-publish.yml

Co-authored-by: stipsan <81981+stipsan@users.noreply.github.com>

Copilot

Pull request overview

Updates the repository’s trusted publishing setup guidance to use the new npm trust github CLI flow (npm >= 11.10.0), replacing most manual npmjs.com UI steps with a single command while keeping a manual fallback.

Changes:

Updated scaffolding instructions/templates to lead with npm trust github <package> --file=release.yml --repository=sanity-io/plugins.
Updated contributor/agent docs to reflect the CLI-first flow, with manual UI steps moved under <details>.
Updated the “setup-trusted-publish” workflow to echo the CLI command after creating the initial package.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
`turbo/generators/templates/README.todo.md.hbs`	CLI-first trusted publishing instructions for generated plugin TODO README, with manual fallback in `<details>`.
`turbo/generators/config.ts`	Simplifies generator “package doesn’t exist yet” instructions to point to `npm trust github`.
`CONTRIBUTING.md`	Updates new/existing package guidance to use `npm trust github`, preserves manual fallback in `<details>`.
`AGENTS.md`	Updates trusted publishing quick reference to use the CLI command.
`.github/workflows/setup-trusted-publish.yml`	Adds a post-step that prints the `npm trust github` command to run locally.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

turbo/generators/templates/README.todo.md.hbs

CONTRIBUTING.md

turbo/generators/templates/README.todo.md.hbs

Initial plan

c8bc414

Copilot AI assigned Copilot and stipsan Mar 4, 2026

Copilot started work on behalf of stipsan March 4, 2026 11:15 View session

vercel bot deployed to Preview March 4, 2026 11:16 View deployment

vercel bot deployed to Preview March 4, 2026 11:23 View deployment

Copilot AI changed the title ~~[WIP] Investigate automated setup for trusted publishing~~ Automate npm trusted publishing setup via npm trust CLI Mar 4, 2026

Copilot finished work on behalf of stipsan March 4, 2026 11:26

stipsan requested changes Mar 5, 2026

View reviewed changes

.github/workflows/setup-trusted-publish.yml Show resolved Hide resolved

Copilot started work on behalf of stipsan March 5, 2026 08:14 View session

Remove OTP input, just echo local CLI instructions instead

56cedf6

Co-authored-by: stipsan <81981+stipsan@users.noreply.github.com>

vercel bot deployed to Preview March 5, 2026 08:16 View deployment

Copilot finished work on behalf of stipsan March 5, 2026 08:17

stipsan approved these changes Mar 5, 2026

View reviewed changes

stipsan marked this pull request as ready for review March 5, 2026 08:21

Copilot AI review requested due to automatic review settings March 5, 2026 08:21

Copilot started reviewing on behalf of stipsan March 5, 2026 08:21 View session

Copilot AI reviewed Mar 5, 2026

View reviewed changes

turbo/generators/templates/README.todo.md.hbs Show resolved Hide resolved

CONTRIBUTING.md Show resolved Hide resolved

turbo/generators/templates/README.todo.md.hbs Show resolved Hide resolved

pedrobonamin reviewed Mar 5, 2026

View reviewed changes

turbo/generators/templates/README.todo.md.hbs Show resolved Hide resolved

stipsan enabled auto-merge (squash) March 5, 2026 08:37

stipsan disabled auto-merge March 6, 2026 09:11

stipsan merged commit a4d82c9 into main Mar 6, 2026
13 checks passed

stipsan deleted the copilot/investigate-trusted-publishing-automation branch March 6, 2026 09:11

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Automate npm trusted publishing setup via `npm trust` CLI#643

Automate npm trusted publishing setup via `npm trust` CLI#643
stipsan merged 3 commits intomainfrom
copilot/investigate-trusted-publishing-automation

Copilot AI commented Mar 4, 2026 •

edited

Loading

Uh oh!

vercel bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

changeset-bot bot commented Mar 4, 2026 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Copilot AI commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Workflow (setup-trusted-publish.yml)

Generator & templates

Documentation

Uh oh!

vercel bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

changeset-bot bot commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented Mar 4, 2026 •

edited

Loading

Workflow (`setup-trusted-publish.yml`)

vercel bot commented Mar 4, 2026 •

edited

Loading

changeset-bot bot commented Mar 4, 2026 •

edited

Loading