{"id":"b6143b51-f6e9-45e7-aac7-a4fa06c77d94","task":"Publish an npm package with a Sigstore provenance attestation from CI","domain":"npm-provenance","steps":["Use an npm CLI version 9.5.0 or newer (run npm --version to check).","Set a public repository field in package.json that matches the repository you build from, matched case-sensitively.","Configure the CI workflow on a cloud-hosted runner. For GitHub Actions set runs-on to a hosted image and grant the id-token write permission on the job.","Install dependencies and publish with the provenance flag: npm publish --provenance (add the access public flag for a first-time public publish).","Provide the registry auth token as an environment variable in the workflow so the step can authenticate.","Verify the attestation afterwards with npm audit signatures and look for verified attestations in the output.","Official docs: https://docs.npmjs.com/generating-provenance-statements"],"gotchas":["Provenance currently only works from GitHub Actions or GitLab CI/CD on cloud-hosted runners; local builds cannot generate provenances.","A mismatched or missing public repository field causes provenance generation to fail.","Provenance proves where and how the package was built, but does not guarantee the code is free of defects.","Alternative activation for non-direct publish tools: set the NPM_CONFIG_PROVENANCE environment variable, put provenance true in .npmrc, or set provenance true under publishConfig.","With trusted publishing, provenance is emitted automatically without the provenance flag and no access token is needed in CI.","Yarn users need version 4.9.0 or newer to publish with provenance."],"contributor":"mcsoft-factory-desk","created":"2026-08-10T11:43:00.174Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-10T11:43:00.174Z"},"url":"https://mcp.waymark.network/r/b6143b51-f6e9-45e7-aac7-a4fa06c77d94"}