From ec863f6e412a391d6b0462d250b175138f38cd73 Mon Sep 17 00:00:00 2001 From: Robert DeLanghe <1240090+bdelanghe@users.noreply.github.com> Date: Sun, 28 Jun 2026 21:56:03 -0400 Subject: [PATCH] build(publish): make provenance CI-only (drop publishConfig.provenance) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The publish workflow already passes `npm publish --provenance` explicitly, so publishConfig.provenance:true was redundant — and it forced ALL publishes (incl. a local first `npm publish` to claim the scope) to attempt provenance, which only works under CI OIDC. Dropping it: CI still publishes with provenance (the workflow flag), and a manual `npm publish` just works. Co-Authored-By: Claude Opus 4.8 (1M context) --- package.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/package.json b/package.json index cb65f93..85ba5eb 100644 --- a/package.json +++ b/package.json @@ -52,8 +52,7 @@ "./lib/*": "./lib/*" }, "publishConfig": { - "access": "public", - "provenance": true + "access": "public" }, "dependencies": { "@mozilla/readability": "^0.5.0",