GitHub puts a 48-hour deadline on unused npm trusted publishing setups
Unvalidated npm trusted publishing configurations now expire 48 hours after creation, and npm rejects tokens from comment-triggered GitHub Actions workflows, GitHub said on October 2.
