Let the agent cut the release, keep the approve button for yourself: npm staged publishing from Actions

Thu, 08 Oct 2026 16:03:00 +0000

Picture the release step in a repo where a coding agent does a lot of the work. It bumps the version, writes the changelog from the merged PRs, opens the release PR. Then somebody has to publish, and the publish credential has to live somewhere the automation can reach it. That’s the part nobody loves: either a long-lived npm token in CI secrets, or a human at a laptop typing a one-time code.

Github-Actions on Tokenise

Let the agent cut the release, keep the approve button for yourself: npm staged publishing from Actions