From 3a14bcc78379c079ec783e577f1012719ad57fc3 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ernesto=20Garc=C3=ADa?= <ernestognw@gmail.com>
Date: Mon, 21 Apr 2025 16:53:38 -0600
Subject: [PATCH] Add provenance to NPM publish during release cycle (#5644)

---
 scripts/release/workflow/publish.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/scripts/release/workflow/publish.sh b/scripts/release/workflow/publish.sh
index e490e5d00..131d02854 100644
--- a/scripts/release/workflow/publish.sh
+++ b/scripts/release/workflow/publish.sh
@@ -9,7 +9,7 @@ PACKAGE_JSON_VERSION="$(tar xfO "$TARBALL" package/package.json | jq -r .version
 echo "//registry.npmjs.org/:_authToken=\${NPM_TOKEN}" > .npmrc
 
 # Actual publish
-npm publish "$TARBALL" --tag "$TAG"
+npm publish --provenance "$TARBALL" --tag "$TAG"
 
 # Clean up tags
 delete_tag() {