diff --git a/.github/main.workflow b/.github/main.workflow
index b46990b2acc7..c5156c783d52 100644
--- a/.github/main.workflow
+++ b/.github/main.workflow
@@ -17,7 +17,7 @@ action "Publish to npm" {
   uses = "docker://node:10"
   secrets = ["NPM_TOKEN"]
   runs = "make"
-  args = "publish"
+  args = "publish-ci"
   env = {
     CI = "true"
   }
diff --git a/.gitignore b/.gitignore
index 70e6db5ea838..2f99b017304b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
+.npmrc
+
 .DS_Store
 /node_modules
 /.github/actions/*/node_modules
diff --git a/Makefile b/Makefile
index df0e3388f3f1..c9f4feeea988 100644
--- a/Makefile
+++ b/Makefile
@@ -64,6 +64,7 @@ fix-json:
 	./node_modules/.bin/prettier "{packages,codemod}/*/test/fixtures/**/options.json" --write --loglevel warn
 
 clean: test-clean
+	rm -f .npmrc
 	rm -rf packages/babel-polyfill/browser*
 	rm -rf packages/babel-polyfill/dist
 	rm -rf coverage
@@ -140,6 +141,17 @@ publish: prepublish
 	./node_modules/.bin/lerna publish from-git --require-scripts
 	make clean
 
+publish-ci: prepublish
+ifneq ("$(NPM_TOKEN)", "")
+	echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc
+else
+	echo "Missing NPM_TOKEN env var"
+	exit 1
+endif
+	./node_modules/.bin/lerna publish from-git --require-scripts --yes
+	rm -f .npmrc
+	make clean
+
 bootstrap-only: clean-all
 	yarn --ignore-engines
 	./node_modules/.bin/lerna bootstrap -- --ignore-engines