From b3c64e97e4ba5db40cef732be79ad5cf33e0754d Mon Sep 17 00:00:00 2001 From: Nathan Rodd Date: Thu, 16 Jul 2026 17:21:31 -0400 Subject: [PATCH] Re-enable npm provenance (merge after repo is public) Restores the provenance publishing that was dropped in the 0.1.6 fix: adds --provenance back to the release workflow and provenance: true to publishConfig. DO NOT MERGE until fullstorydev/subtext-wizard is made public. npm rejects provenance attestations from private source repos (E422 'Unsupported ... source repository visibility: private'), which is why provenance is currently off. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release.yml | 8 ++++---- package.json | 3 ++- 2 files changed, 6 insertions(+), 5 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 34440bc..0f33f5f 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -50,7 +50,7 @@ jobs: run: npm run build - name: Publish npm package - # NO --provenance: npm rejects provenance attestations from private - # source repos (E422 "Unsupported ... visibility: private"). This repo - # is private, so provenance was intentionally dropped in 059d114. - run: npm publish --access public + # --provenance is automatic under trusted publishing, but explicit is + # self-documenting. Only valid once the source repo is PUBLIC — npm + # rejects provenance from private repos (E422). + run: npm publish --access public --provenance diff --git a/package.json b/package.json index 002c6ab..d7c6300 100644 --- a/package.json +++ b/package.json @@ -9,7 +9,8 @@ "url": "https://github.com/fullstorydev/subtext-wizard.git" }, "publishConfig": { - "access": "public" + "access": "public", + "provenance": true }, "keywords": [ "subtext",