I noticed publish.yml runs npm publish (and npm publish --tag "$PRERELEASE_TAG") without --provenance, even though the workflow already has id-token: write for trusted publishing. opencore-cli's publish workflow does pass --provenance, so I think it's worth aligning:
npm publish --provenance
npm publish --provenance --tag "$PRERELEASE_TAG"
Split out from #65.
I noticed
publish.ymlrunsnpm publish(andnpm publish --tag "$PRERELEASE_TAG") without--provenance, even though the workflow already hasid-token: writefor trusted publishing.opencore-cli's publish workflow does pass--provenance, so I think it's worth aligning:npm publish --provenance npm publish --provenance --tag "$PRERELEASE_TAG"Split out from #65.