From ab28ddbf4527ab34a5961c72d3a5eacf3b8b1ef8 Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 13 Jun 2026 05:21:33 +0000 Subject: [PATCH] fix: correct npm provenance config in release workflow `changeset publish` never accepted a `--provenance` flag (only --tag/--otp/--no-git-tag). @changesets/cli silently ignored it through 2.29.x, but 2.31.0 validates flags strictly and now errors: "Unknown flag for publish: --provenance", failing the release job. Drop the invalid flag and enable provenance the supported way: set NPM_CONFIG_PROVENANCE=true in the publish step env, which npm reads when changeset publish shells out to `npm publish` (id-token: write is already granted). This also means provenance is actually applied now, rather than being silently dropped as before. --- .github/workflows/release.yml | 2 ++ package.json | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c9e681b..e0e73e3 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -45,3 +45,5 @@ jobs: commit: 'chore: version packages' env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} + # npm reads this to emit provenance (needs id-token: write, set above). + NPM_CONFIG_PROVENANCE: true diff --git a/package.json b/package.json index 6eae7c5..22283f6 100644 --- a/package.json +++ b/package.json @@ -25,7 +25,7 @@ "ci": "biome ci . && tsc --noEmit && ava", "changeset": "changeset", "version-packages": "changeset version && pnpm build:docs", - "release": "pnpm run build && changeset publish --provenance" + "release": "pnpm run build && changeset publish" }, "keywords": [ "pathist",