From 51fe86cf770909e090e5b8140c45f8b39a8f105d Mon Sep 17 00:00:00 2001 From: Adhik Joshi Date: Mon, 24 Aug 2026 14:28:35 +0530 Subject: [PATCH] fix(release): grant id-token write for npm provenance MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit `npm publish --provenance` mints a signed attestation from a GitHub OIDC token and fails the publish outright without `id-token: write` — it does not fall back to an unsigned publish. The workflow only had `contents: write`, so the first tag would have died at the npm step after goreleaser had already cut the release and pushed to Homebrew and Scoop, leaving a half-published version. Caught before tagging rather than by tagging. --- .github/workflows/release.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 5e5e74c..cd05525 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -7,6 +7,10 @@ on: permissions: contents: write + # Required by `npm publish --provenance`: npm mints a signed provenance + # attestation from a GitHub OIDC token, and without this it fails the publish + # outright rather than degrading to an unsigned one. + id-token: write jobs: test: