§ FAQ
Questions before you paste.
§ FAQ
npm trusted publishing FAQ.
+ Who is ForgeKite for?
Library maintainers and DevOps engineers preparing their first npm publish under OIDC trusted publishing — or migrating from a long-lived NPM_TOKEN in GitHub Actions to OIDC.
+ Is the preflight checklist actually working today?
Yes. The 14-row check runs entirely in your browser using the JSON parser and regex over what you paste. Nothing leaves the page.
+ What does this replace?
It replaces the ad-hoc "skim three GitHub Issues and hope I caught it" flow before a v1.0.0 release. It does not replace the actual npm trusted-publisher setup, which still requires a manual click on npmjs.com.
+ When does the full product launch?
The hosted audit (paste a repo URL, get a guided report and a fix PR) is in build. The preflight checklist on the landing page is the standalone artifact you can use today.
+ Is it free?
The checklist on this site is free and stays free. Paid options will be for teams that want a CI-integrated audit and a SLSA-Level-3 evidence ledger.
+ Does ForgeKite store my package.json or workflow?
No. There is no backend on the checklist page. Open DevTools, check the Network tab, paste your files, and run the check — there are no outbound requests for the artifact.
+ Does it support pnpm, yarn, or bun?
The checklist flags pnpm publish as OK and yarn classic publish as a fail (yarn classic does not speak OIDC). Bun publish landed in mid-2026 and is not yet wired to npm trusted publishing.
+ Where does the source list come from?
npm docs (docs.npmjs.com/trusted-publishers), GitHub Actions OIDC docs, npm CLI release notes, Sigstore documentation, and real failure threads from npm/cli and r/javascript. Every blog post lists the exact source IDs.