From 7681d9ae59d48f5642c877dfdee14b7b00848e25 Mon Sep 17 00:00:00 2001 From: masnwilliams <43387599+masnwilliams@users.noreply.github.com> Date: Mon, 20 Jul 2026 23:56:38 +0000 Subject: [PATCH] ci: publish to npm with provenance Adds --provenance to the release publish step so npm records a signed build-provenance attestation (verified GitHub Actions source), matching the attestations @onkernel/cua packages carry. Works with the existing id-token: write + OIDC trusted publishing. Co-Authored-By: Claude Opus 4.8 --- .github/workflows/release.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 1c0de0a..1530c00 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -72,4 +72,4 @@ jobs: node --input-type=module -e "import('@onkernel/eve-extension').then((m) => { if (typeof m.default !== 'function') process.exit(1); })" - name: Publish to npm - run: npm publish --access public + run: npm publish --access public --provenance