Create trusted publisher → publish once within ~48h/2 days → avoid issue_comment as publish trigger. Confirm on npm docs / GitHub changelog.