From e5f4c10eab7f3f9ec0b9ee02a630c8c62dd84d98 Mon Sep 17 00:00:00 2001 From: waterbang Date: Sat, 19 Sep 2026 16:40:01 +0800 Subject: [PATCH] ci: drop redundant --provenance flag Trusted Publishing generates provenance automatically; the explicit flag only added a failure mode for the transitional token fallback. --- .github/workflows/ts-publish-npm.yml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/ts-publish-npm.yml b/.github/workflows/ts-publish-npm.yml index e9fc495..cb72e37 100644 --- a/.github/workflows/ts-publish-npm.yml +++ b/.github/workflows/ts-publish-npm.yml @@ -67,10 +67,11 @@ jobs: fi # Preferred auth is the npmjs.com Trusted Publisher for this workflow - # (no secret, no expiry). NPM_TOKEN is only a fallback while the trusted - # publisher is not configured yet; delete the secret once it is. + # (no secret, no expiry); npm then generates provenance automatically. + # NPM_TOKEN is only a fallback while the trusted publisher is not + # configured yet; delete the secret once it is. - name: Publish to npm working-directory: ts - run: npm publish --tag ${{ steps.npm-tag.outputs.tag }} --access public --provenance + run: npm publish --tag ${{ steps.npm-tag.outputs.tag }} --access public env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}