I love how transitioning to the @GitHub package registry from NPM removes the hassle of having to deal with tokens of any kind if combined with Actions: https://help.github.com/en/articles/virtual-environments-for-github-actions#github_token-secret

All Action runs have a GH token scoped to the repo, which can publish packages to the registry. 💯🚀