According to this description:

npm binds trusted publishing to a repository plus a workflow filename, not to a branch

... making the repo the unit of trust. I celebrate NPM's bold decision to enforce the concept of Git as a distributed system of repos, rather than the centralized model favoured by enterprises of a single repo with branch protection rules...