From c2286cfb29e02f992a0b8c957d209da63f9ba4e8 Mon Sep 17 00:00:00 2001 From: Ivan Matveev Date: Sat, 30 May 2026 20:07:04 +0200 Subject: [PATCH] ci: publish npm package with token auth --- .github/workflows/publish.yml | 1 - README.md | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml index 0519c04..78fe8ff 100644 --- a/.github/workflows/publish.yml +++ b/.github/workflows/publish.yml @@ -38,4 +38,3 @@ jobs: env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} NPM_TOKEN: ${{ secrets.NPM_TOKEN }} - NPM_CONFIG_PROVENANCE: true diff --git a/README.md b/README.md index 1efa6a0..0edce78 100644 --- a/README.md +++ b/README.md @@ -254,7 +254,7 @@ npm run version-packages npm run publish-packages ``` -The workflow sets `NPM_CONFIG_PROVENANCE=true`, so packages are published with npm provenance. +The workflow publishes with the `NPM_TOKEN` repository secret. Use npm trusted publishing later if you want tokenless provenance publishing. Local release commands are still available when needed: