Attach npm provenance only when the repository is public

npm cannot mint a provenance attestation from a private source repository,
so `npm publish --provenance` fails outright there. The flag is now added
only when the run reports a public repository, and `publishConfig.provenance`
no longer forces it regardless.

This keeps the release unblocked while the repository is private and needs
no follow-up edit: making it public is by itself enough for attestation to
come back on the next publish. An unrecognised visibility is treated as
private, which costs the attestation rather than the release.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: AlexLovser

.github/workflows/publish.yml

@@ -1,6 +1,7 @@
 name: Publish
 
-# Publishes to npm with provenance attestation (OIDC).
+# Publishes to npm. Provenance attestation (OIDC) is added when the repository
+# is public — npm cannot mint it from a private source.
 # Requires either npm Trusted Publishing configured for
 # SkyLink-API/SkyLink-API-TypeScript-SDK, or an NPM_ACCESS_TOKEN repository secret
 # (automation token) as a fallback.
@@ -76,6 +77,17 @@ jobs:
 
       - name: Publish to npm
         if: steps.npm.outputs.unpublished == 'true'
-        run: npm publish --provenance --access public
+        # npm refuses to mint provenance from a private repository. The flag is
+        # therefore added only when the source is public, so making the repo
+        # public is the single action needed to get attestation back — nothing
+        # here has to change. An unknown visibility is treated as private, which
+        # costs the attestation rather than the release.
+        run: |
+          if [ "${{ github.event.repository.visibility }}" = "public" ]; then
+            npm publish --provenance --access public
+          else
+            echo "::warning::Repository is not public — publishing without provenance."
+            npm publish --access public
+          fi
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_ACCESS_TOKEN }}

README.md

@@ -772,9 +772,12 @@ so it arms only on the direct channel (or an explicit `baseUrl`) and reports as
 otherwise. Everything it creates points at an unreachable `example.com` URL and is deleted
 afterwards, pass or fail.
 
-Publishing is automated: pushing a `v*` tag builds the package and runs
-`npm publish --provenance --access public` via OIDC. The npm trusted publisher must be
-configured for `SkyLink-API/SkyLink-API-TypeScript-SDK` beforehand.
+Publishing is automated: a push to `main` (or a `v*` tag) lints, type-checks, tests and
+builds the package, then publishes it when `package.json` holds a version that is not on
+npm yet — so merging a version bump releases it and any other merge is a no-op. Provenance
+attestation is attached when the repository is public; npm cannot mint it from a private
+source. Authentication comes from the `NPM_ACCESS_TOKEN` secret, or from npm trusted
+publishing (OIDC) once it is configured for `SkyLink-API/SkyLink-API-TypeScript-SDK`.
 
 ## License
 

package.json

@@ -148,8 +148,7 @@
     "url": "https://github.com/SkyLink-API/SkyLink-API-TypeScript-SDK/issues"
   },
   "publishConfig": {
-    "access": "public",
-    "provenance": true
+    "access": "public"
   },
   "devDependencies": {
     "@biomejs/biome": "^2.0.0",