setup-node

npm Trusted Publishers allow publishing via OpenID Connect (OIDC) instead of static tokens.

Requirements

• npm ≥ 11.5.1 (required)
• Node.js 24 or newer (recommended)
• A Trusted Publisher must be configured in npm for your specific GitHub repository and workflow.

Implementation

1. Set permissions to include id-token: write.
2. Set package-manager-cache: false to prevent credential exposure via cache poisoning.

Note: If the Trusted Publisher configuration does not match the workflow run identity exactly, publishing will fail with E404 Not Found.

    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@v7

      - uses: actions/setup-node@v7
        with:
          node-version: '24'
          registry-url: 'https://registry.npmjs.org'
          package-manager-cache: false

      - run: npm ci
      - run: npm run build --if-present
      - run: npm publish

You can speed up dependency installation by enabling built-in caching for npm or yarn within the actions/setup-node action. This eliminates the need for manual actions/cache configuration for standard use cases.

Requirements & Behavior:

• The action expects package-lock.json (for npm) or yarn.lock (for yarn) to be located in the repository root. If neither file is found, the action will throw an error.
• The cache key is automatically generated using the hash of the lock file and the runner OS (e.g., ${{ runner.os }}-npm-${{ hashFiles('package-lock.json') }}).
• Caching is disabled by default.

Supported cache input values:

• npm: Enable caching for npm dependencies.
• yarn: Enable caching for yarn dependencies.
• '' (empty string): Disable caching (default).

### Npm package manager
```yml
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v2
  with:
    node-version: '14'
    cache: npm

Yarn package manager

steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v2
  with:
    node-version: '14'
    cache: yarn

The action can automatically cache global package data to speed up workflows. This follows actions/cache guidelines and caches the global cache on the machine rather than node_modules, allowing reuse across different Node.js versions.

Yarn Caching

Supports Yarn Classic (v1) and Yarn Berry (v2, v3, v4+).

pnpm Caching

Requires pnpm version >= 6.10.0.

Customizing Cache Paths

You can use cache-dependency-path to specify which files trigger a cache update:

• Wildcard patterns: e.g., **/package-lock.json.
• List of paths: A multi-line string of specific file paths.

# Yarn example
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
  with:
    node-version: '24'
    cache: 'yarn'
- run: yarn install --frozen-lockfile

# pnpm example (requires pnpm >= 6.10.0)
steps:
- uses: actions/checkout@v7
- uses: pnpm/action-setup@v6
  with:
    version: 10
- uses: actions/setup-node@v7
  with:
    node-version: '24'
    cache: 'pnpm'
- run: pnpm install

# Custom dependency paths (npm example)
steps:
- uses: actions/checkout@v7
- uses: actions/setup-node@v7
  with:
    node-version: '24'
    cache: 'npm'
    cache-dependency-path: '**/package-lock.json'
- run: npm ci

When using a monorepo or a repository where the dependency lock file (package-lock.json or yarn.lock) is not located in the repository root, use the cache-dependency-path input.

This input accepts a path (relative to the repository root) to the dependency lock file. If you provide a path containing wildcards, the action will search for all matching files and use a hash of those files as part of the cache key, similar to how ${{ hashFiles('...') }} works in GitHub Actions workflows.

Supported use cases:

• Specifying a specific lock file in a subdirectory.
• Using file patterns (e.g., **/package-lock.json) to match multiple files.
• Specifying custom dependency files like src/npm-shrinkwrap.json.
• Overriding the default resolution priority between yarn.lock and package-lock.json.

steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v2
  with:
    node-version: 14
    cache: npm
    cache-dependency-path: 'sub-project/package-lock.json'