# Publish packages to JSR

JSR targets modern ESM packages, encourages publishing TypeScript source, and generates API documentation. JSR packages can be consumed from Deno, Node.js, and other tools.

## Minimal package configuration

```json title="deno.json"
{
  "name": "@scope/greet",
  "version": "1.0.0",
  "exports": {
    ".": "./mod.ts",
    "./testing": "./testing.ts"
  },
  "publish": {
    "exclude": ["coverage", "*.snap"]
  }
}
```

JSR publishes ESM only. File names must work on Windows and Unix, and cross-file imports must resolve at publication. Avoid slow types in public APIs to improve checking, generated docs, and Node compatibility.

## Pre-publication verification

```bash
deno fmt --check
deno lint
deno check mod.ts
deno test
deno publish --dry-run
```

`--dry-run` lists actual upload files and runs registry validation. Published versions are immutable and cannot be deleted; yank a critically broken version or archive an abandoned package.

## GitHub Actions OIDC

Link the GitHub repository in JSR package settings, then grant the workflow an OIDC token:

```yaml title=".github/workflows/publish.yml"
name: publish
on:
  push:
    tags: ["v*"]
jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write
    steps:
      - uses: actions/checkout@v7
      - uses: denoland/setup-deno@v2
        with:
          deno-version: v2.x
      - run: deno publish
```

OIDC avoids a long-lived publication token and produces a provenance attestation. Other CI providers can use `--token`, but official docs state that token publication does not generate provenance.

<Callout type="warn" title="Publishing is externally irreversible">
Before `deno publish`, confirm scope, version, tag, changelog, and the exact file list. A successful dry run does not authorize an agent to publish.
</Callout>

Official sources: [Publishing packages](https://jsr.io/docs/publishing-packages), [Package configuration](https://jsr.io/docs/package-configuration), and [Packages and versions](https://jsr.io/docs/packages).