{"version":"1.0","generated_at":"2026-10-01T09:56:22.920526","id":3166,"slug":"opt-in-dist-tag-permissions-for-npm-trusted-publishing","title":"npm 可信发布新增 dist-tag 权限的主动开启选项","summary":"npm 可信发布配置现在可被授予管理 dist-tag 的权限，用短时 OIDC 凭证替代长期访问令牌。该权限默认关闭，新旧配置都不会自动获得，且与直接发布相互独立；原有的基于令牌的 dist-tag 管理方式不受影响。","abstract":"npm 可信发布新增 dist-tag 权限的主动开启选项 npm 可信发布配置现在可被授予管理 dist-tag 的权限，用短时 OIDC 凭证替代长期访问令牌。该权限默认关闭，新旧配置都不会自动获得，且与直接发布相互独立；原有的基于令牌的 dist-tag 管理方式不受影响。 npm 可信发布配置现在可被授予管理 dist-tag 的权限，用短时 OIDC 凭证替代长期访问令牌。该权限默认关闭，新旧配置都不会自动获得，且与直接发布相互独立；原有的基于令牌的 dist-tag 管理方式不受影响。 原贴提到：Trusted publishing configurations for npm can now be granted permission 来源：github.blog npm 的可信发布配置现在可以被授予管理 dist-tag 的权限（例如将某个版本提升为 latest、更新 next 和 beta 指针），使用短期的 OIDC 凭证而不是长期有效的访问令牌。 此前，可信发布覆盖了发布和暂存，但不包括 dist-tag 操作。 这意味着那些在其他方面已完全转向无令牌、基于 OIDC 工作流的维护者，仍然不得不保留一个细粒度访问令牌，仅仅是为了在发布或回滚之后管理标签。 每个可信发布配置现在都有一个需主动开启的 Allow npm dist-tag 权限。对于新建和现有配置，它都默认为关闭，因此没有任何配置会自动获得新能力。 该权限独立于直接发布，因此仅用于暂存的配置也可以被授予 dist-tag 管理权限。 如果传入的 OIDC 令牌匹配任意一个已启用该权限的配置…","access_level":"public","access_label":"公开","access_mode":"full","is_preview":false,"canonical_url":"https://opc.beizhux.com/content/3166/opt-in-dist-tag-permissions-for-npm-trusted-publishing","html_url":"https://opc.beizhux.com/content/3166/opt-in-dist-tag-permissions-for-npm-trusted-publishing","json_url":"https://opc.beizhux.com/content/3166/opt-in-dist-tag-permissions-for-npm-trusted-publishing.json","published_at":"2026-10-01T05:03:09","updated_at":"2026-10-01T09:16:28","category":{"slug":"hotspots","name":"全球热点解读"},"source":{"site":"github.blog","author":"Allison","url":"https://github.blog/changelog/2026-09-30-opt-in-dist-tag-permissions-for-npm-trusted-publishing"},"tags":["CI/CD","DevOps","dist-tag","npm","OIDC","供应链安全","可信发布"],"topics":[{"slug":"ai-daily","name":"AI日报","url":"https://opc.beizhux.com/topics/ai-daily","reason":"这篇内容命中「热点解读」等主题信号。"},{"slug":"ai-tools","name":"AI工具","url":"https://opc.beizhux.com/topics/ai-tools","reason":"这篇内容来自该专题长期覆盖的栏目。"},{"slug":"agent-workflow","name":"Agent工作流","url":"https://opc.beizhux.com/topics/agent-workflow","reason":"这篇内容来自该专题长期覆盖的栏目。"}],"keywords":["全球热点解读","AI日报","AI工具","Agent工作流","每日AI日报","AI信号","热点解读","BuilderPulse","工具","自动化","模型","Cursor"],"questions":[{"question":"npm 可信发布新增 dist-tag 权限的主动开启选项主要讲什么？","answer":"npm 可信发布配置现在可被授予管理 dist-tag 的权限，用短时 OIDC 凭证替代长期访问令牌。该权限默认关闭，新旧配置都不会自动获得，且与直接发布相互独立；原有的基于令牌的 dist-tag 管理方式不受影响。"},{"question":"这篇文章最值得关注的要点是什么？","answer":"npm 可信发布配置现在可被授予管理 dist-tag 的权限，用短时 OIDC 凭证替代长期访问令牌。该权限默认关闭，新旧配置都不会自动获得，且与直接发布相互独立；原有的基于令牌的 dist-tag 管理方式不受影响。；原贴提到：Trusted publishing configurations for npm can now be granted permission；来源：github.blog"},{"question":"这篇文章和哪些AI专题相关？","answer":"它适合放在AI日报、AI工具、Agent工作流专题里阅读。 关联原因：这篇内容命中「热点解读」等主题信号。；这篇内容来自该专题长期覆盖的栏目。；这篇内容来自该专题长期覆盖的栏目。"},{"question":"阅读这篇文章建议先理解哪些关键词？","answer":"建议先理解AI日报、每日AI日报、AI信号、热点解读、BuilderPulse这些关键词，再结合正文判断工具、机会或风险是否值得进入自己的工作流。"}],"terms":[{"slug":"ai-daily-term","name":"AI日报","definition":"在AI觉醒星球里，「AI日报」属于「AI日报」方向。持续整理每日AI日报、模型更新、工具变化和行业信号，帮你快速判断哪些信息值得收藏、验证和行动。 每天先看趋势，再决定今天该试什么。","topic_slug":"ai-daily","topic_name":"AI日报","topic_title":"AI日报：每日AI信号、工具动态与行动判断","topic_url":"https://opc.beizhux.com/topics/ai-daily","topic_path":"/topics/ai-daily","url":"https://opc.beizhux.com/glossary/ai-daily-term","path":"/glossary/ai-daily-term","json_url":"https://opc.beizhux.com/glossary/ai-daily-term.json"},{"slug":"daily-ai-briefing","name":"每日AI日报","definition":"在AI觉醒星球里，「每日AI日报」属于「AI日报」方向。持续整理每日AI日报、模型更新、工具变化和行业信号，帮你快速判断哪些信息值得收藏、验证和行动。 每天先看趋势，再决定今天该试什么。","topic_slug":"ai-daily","topic_name":"AI日报","topic_title":"AI日报：每日AI信号、工具动态与行动判断","topic_url":"https://opc.beizhux.com/topics/ai-daily","topic_path":"/topics/ai-daily","url":"https://opc.beizhux.com/glossary/daily-ai-briefing","path":"/glossary/daily-ai-briefing","json_url":"https://opc.beizhux.com/glossary/daily-ai-briefing.json"},{"slug":"ai-signal","name":"AI信号","definition":"在AI觉醒星球里，「AI信号」属于「AI日报」方向。持续整理每日AI日报、模型更新、工具变化和行业信号，帮你快速判断哪些信息值得收藏、验证和行动。 每天先看趋势，再决定今天该试什么。","topic_slug":"ai-daily","topic_name":"AI日报","topic_title":"AI日报：每日AI信号、工具动态与行动判断","topic_url":"https://opc.beizhux.com/topics/ai-daily","topic_path":"/topics/ai-daily","url":"https://opc.beizhux.com/glossary/ai-signal","path":"/glossary/ai-signal","json_url":"https://opc.beizhux.com/glossary/ai-signal.json"},{"slug":"ai-news-analysis","name":"热点解读","definition":"在AI觉醒星球里，「热点解读」属于「AI日报」方向。持续整理每日AI日报、模型更新、工具变化和行业信号，帮你快速判断哪些信息值得收藏、验证和行动。 每天先看趋势，再决定今天该试什么。","topic_slug":"ai-daily","topic_name":"AI日报","topic_title":"AI日报：每日AI信号、工具动态与行动判断","topic_url":"https://opc.beizhux.com/topics/ai-daily","topic_path":"/topics/ai-daily","url":"https://opc.beizhux.com/glossary/ai-news-analysis","path":"/glossary/ai-news-analysis","json_url":"https://opc.beizhux.com/glossary/ai-news-analysis.json"},{"slug":"builderpulse","name":"BuilderPulse","definition":"在AI觉醒星球里，「BuilderPulse」属于「AI日报」方向。持续整理每日AI日报、模型更新、工具变化和行业信号，帮你快速判断哪些信息值得收藏、验证和行动。 每天先看趋势，再决定今天该试什么。","topic_slug":"ai-daily","topic_name":"AI日报","topic_title":"AI日报：每日AI信号、工具动态与行动判断","topic_url":"https://opc.beizhux.com/topics/ai-daily","topic_path":"/topics/ai-daily","url":"https://opc.beizhux.com/glossary/builderpulse","path":"/glossary/builderpulse","json_url":"https://opc.beizhux.com/glossary/builderpulse.json"},{"slug":"ai-tools-term","name":"AI工具","definition":"在AI觉醒星球里，「AI工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/ai-tools-term","path":"/glossary/ai-tools-term","json_url":"https://opc.beizhux.com/glossary/ai-tools-term.json"},{"slug":"tools","name":"工具","definition":"在AI觉醒星球里，「工具」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/tools","path":"/glossary/tools","json_url":"https://opc.beizhux.com/glossary/tools.json"},{"slug":"automation","name":"自动化","definition":"在AI觉醒星球里，「自动化」属于「AI工具」方向。围绕AI工具、模型能力、自动化流程和真实使用场景做整理，优先关注能提升效率、降低成本和创造新交付的工具。 不只看工具热度，更看它能不能进入真实流程。","topic_slug":"ai-tools","topic_name":"AI工具","topic_title":"AI工具：模型、插件、自动化与实战场景","topic_url":"https://opc.beizhux.com/topics/ai-tools","topic_path":"/topics/ai-tools","url":"https://opc.beizhux.com/glossary/automation","path":"/glossary/automation","json_url":"https://opc.beizhux.com/glossary/automation.json"}],"preview_hidden_sections":[],"related_items":[{"id":3178,"title":"【必读】每日AI日报 2026-10-01","url":"https://opc.beizhux.com/content/3178/aihot-daily-2026-10-01","summary":"AIHOT 每日 AI 日报：模型发布/更新： - OpenAI 发布 GPT-6.1 Sol：以 Astra 五分之一价格接近其编码与计算机操作水平：OpenAI 发布 GPT-6.1 Sol，定价为每百万 token 2 美元输入、10 美元输出、0.10 美元缓存输入，为 GPT-6 Astra 标准价格约五分…","access_level":"public"},{"id":3164,"title":"Gemini 4 Argon (High) 登 Arena Agent Arena 第 8 名，净提升 +7.92%","url":"https://opc.beizhux.com/content/3164/gemini-4-argon-high-arena-agent-arena-8-7-92","summary":"Arena 公布 Gemini 4 Argon (High) 在 Agent Arena 排名第 8，净提升 +7.92%，每任务成本 $0.62。对 agent 选型来说，能力表现与单任务成本同时出现，值得纳入初筛对比。","access_level":"public"},{"id":3169,"title":"Perplexity 开放 Computer 邮件委托入口并限时免费运行任务","url":"https://opc.beizhux.com/content/3169/perplexity-computer","summary":"Perplexity 向所有人开放 Computer 的邮件委托功能，无需账号，转发或抄送任务到 computer@perplexity.com 即可限时免费运行。智能体在后台完成任务并保留邮件上下文，任务可在网页和移动端查看，并带有与应用内任务相同的审计记录。","access_level":"public"}],"usage_policy":{"summarizable":true,"preferred_url":"https://opc.beizhux.com/content/3166/opt-in-dist-tag-permissions-for-npm-trusted-publishing","private_fields_excluded":true}}