This is exactly why GitHub support OpenID Connect, https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-wi

This is exactly why GitHub support OpenID Connect, https://docs.github.com/en/actions/deployment/security-hardening-your-deployments/about-security-hardening-with-openid-connect https://docs.github.com/en/actions/deployment/security-harde..., so that long-lived secrets don't need to be present as part of the build. I'm not sure if NPM supports OIDC, which would be ironic given that both GitHub and NPM are owned by Microsoft.