GitHub adds opt-in OIDC permission for npm dist-tag management

npm trusted publishing configurations can now use short-lived OIDC credentials to manage dist-tags, including version promotion and updates to channels such as latest, next and beta. Previously, maintainers who had shifted publishing and staging to OIDC still needed to keep a granular access token for tag operations.

The new Allow npm dist-tag permission is off by default for both new and existing configurations, so administrators must enable it deliberately. It is separate from direct publishing, meaning a staging-only configuration can also receive permission to manage tags. An operation is authorized when its OIDC token matches any one configuration where the permission is enabled. Existing token-based tag management remains unchanged. Administrators can enable the setting in their package’s trusted publishing settings.