Publish the n8n node and get it verified

Release n8n-nodes-veefore to npm with provenance from a public repository, and submit it for n8n Cloud verification.

This is the maintainer's procedure for releasing n8n-nodes-veefore and making it installable on n8n Cloud. You need: the public GitHub repository for the node, an npmjs.com account, and an n8n Creator Portal account.

Why each requirement exists

n8n Cloud installs only verified nodes. Since 1 May 2026 n8n verifies only packages published to npm from GitHub Actions with a provenance statement, and npm generates provenance only for a public repository. n8n's linter also expects the MIT license for verified nodes. The node package is MIT; the rest of Veefore keeps its own license.

#What the package already meets

Requirement	Where
Name starts `n8n-nodes-`	`n8n-nodes-veefore`
Keyword `n8n-community-node-package`	`package.json`
Nodes and credentials under `n8n` in `package.json`	`dist/nodes/Veefore/Veefore.node.js`, `dist/credentials/VeeforeApi.credentials.js`
No runtime dependencies; only `n8n-workflow` and `node:crypto`	`package.json`
Built and linted with `@n8n/node-cli` (0.23 or later)	`npm run build`, `npm run lint` (clean)
README in the package	`README.md`
MIT license	`LICENSE`
GitHub Actions publish with provenance	`.github/workflows/publish.yml`
Light and dark icons	`nodes/Veefore/veefore{,.dark}.svg`

#Step by step

Copy the package into the public repository

Copy everything in integrations/n8n-nodes-veefore/ of the Veefore repository into the root of the public repository, including .github/, LICENSE, package-lock.json and eslint.config.mjs. Leave out node_modules/ and dist/.

bash
rsync -a --exclude node_modules --exclude dist \
  integrations/n8n-nodes-veefore/ ../n8n-nodes-veefore/
cd ../n8n-nodes-veefore

Set repository.url in package.json to the public repository, then commit and push.

Check it locally

bash
npm ci --ignore-scripts
npm run lint
npm run build
npm pack --dry-run

lint must report no problems. pack lists dist/, LICENSE, README.md and package.json.

Connect npm to the repository

On npmjs.com, sign in. Choose one:

Trusted publishing (recommended, no secret). If the package exists: n8n-nodes-veefore → Settings → Publish access → Trusted Publishers → Add → GitHub Actions, with your organization, the repository name and workflow publish.yml.
Token (needed for the very first publish if npm will not add a trusted publisher to a package that does not exist yet). Access Tokens → Generate → Granular Access Token, read and write, limited to n8n-nodes-veefore (or all packages for the first publish, then narrow it). In GitHub: Settings → Secrets and variables → Actions → New secret, name NPM_TOKEN. After the first release, switch to trusted publishing and delete the secret.

Release

In the public repository:

bash
npm run release

It lints, builds, asks for the version (start with 1.0.0), updates the changelog, commits, tags and pushes. The tag starts the Publish workflow. Watch it under Actions; it ends with the package on npm.

Confirm provenance and scan it

On the package's npm page, a Provenance section links to the workflow run and commit. Then:

bash
npx @n8n/scan-community-package n8n-nodes-veefore

It must pass. This is the same check n8n runs first.

Submit for verification

Sign in at creators.n8n.io, submit n8n-nodes-veefore, and give a short description: "Runs actions from workflows and AI agents through Veefore's policy, approval and credential broker." n8n reviews it against its technical and UX guidelines. Reviews can take several weeks; the portal shows the status.

After approval

The node appears in the n8n Cloud nodes panel as Veefore. Update n8n Cloud to send users to it, and keep the MCP route as an alternative.

#Releasing an update

Change the code in the Veefore repository, run the live test (scripts/smoke-n8n-live.ts) against a real n8n, copy the package to the public repository again, and npm run release. Every version must come from the workflow; a version published from a laptop has no provenance and n8n will not accept it.

#If n8n rejects it

Message	Usual cause
"Some tests have failed"	Run `npx @n8n/scan-community-package n8n-nodes-veefore` and fix what it lists.
Missing provenance	The version was published from a laptop, or the repository was private. Publish a new version from the workflow.
License	`package.json` must say `MIT` and `LICENSE` must be in the package.
Runtime dependency	Nothing may be listed under `dependencies`.
"Missing credential test"	The credential type needs its own `test` request. `VeeforeApi` signs an assertion in `preAuthentication`, stores the session token in a hidden expirable field, and tests with an authenticated `GET /gateway/v1/tools`. A node-level `testedBy` method does not count.