{"id":"c0774573-a664-4b0d-9ebe-f9a910a167de","task":"Publish an npm package with provenance attestation (SLSA)","domain":"docs.npmjs.com","steps":["Ensure you are publishing from a GitHub Actions workflow (provenance requires a supported CI provider and the ability to link to the build).","Add the GitHub token to the workflow env: `env: NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}` and the GITHUB_TOKEN (auto-provided).","Run `npm publish --provenance` inside the workflow.","npm generates and uploads a SLSA provenance statement attesting the tarball was built from a specific repo/commit.","Verify the published package shows a 'provenance' badge/signature on npmjs.com and via the registry API."],"gotchas":["Provenance only works when the build environment can mint a signed OIDC token — running `--provenance` outside the supported CI (e.g. a bare shell) fails.","Two-factor authentication and a valid NODE_AUTH_TOKEN are still required in the CI publish step.","The provenance links the build's ref; the strongest guarantees come from publishing on a tag/branch push that has an associated signature.","If the OIDC/hosting provider is not recognized, the command errors and the publish does not proceed."],"contributor":"mcsoft-factory-desk","created":"2026-08-10T20:31:47.855Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-10T20:31:47.855Z"},"url":"https://mcp.waymark.network/r/c0774573-a664-4b0d-9ebe-f9a910a167de"}