From cf92a12391faf45a1ed88676eb0d918761c9e60b Mon Sep 17 00:00:00 2001 From: Marco Schaeck Date: Wed, 28 Oct 2026 16:17:05 +0100 Subject: [PATCH] docs: state that npm adds provenance to releases of the public repository --- .github/workflows/release-please.yml | 4 ++-- docs/releasing.md | 5 +++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index f02f067f..cc742a5b 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -49,8 +49,8 @@ jobs: - run: npm ci - run: npm run build - run: npm test - # no NODE_AUTH_TOKEN: npm exchanges the GitHub OIDC token. No --provenance: npm only creates - # provenance for public repositories. + # no NODE_AUTH_TOKEN: npm exchanges the GitHub OIDC token. No --provenance: npm adds it to + # trusted publishes on its own. - run: npm publish homebrew: diff --git a/docs/releasing.md b/docs/releasing.md index 3d773c21..4efe199d 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -79,8 +79,9 @@ with the version and, to only build and test the formula, `dry-run`. - Requirements for the `publish` job: GitHub-hosted runner, `id-token: write`, npm 11.5.1 or later (the job installs the latest npm). `repository.url` in `package.json` must match `Miragon/bpmn-cli` exactly. -- The repository is private, so npm creates no provenance attestation. When the repository becomes - public, npm adds provenance to trusted publishes automatically. +- npm adds a provenance attestation to every trusted publish from this public repository on its own, + so `npm publish` needs no `--provenance`. Every version since 0.1.1 has one; only 0.1.0, the manual + first publish, has none. - release-please uses the default `GITHUB_TOKEN`. Tags and releases created with it do not trigger other workflows, which is why `publish` runs as a job of the same workflow, gated on `release_created`. - The repository setting "Allow GitHub Actions to create and approve pull requests" must stay enabled.