From 4f67cbeb4d255d6585365b95989fb2a4b93f0289 Mon Sep 17 00:00:00 2001
From: Boaz Poolman <boaz_skater@hotmail.com>
Date: Mon, 2 Mar 2026 14:04:47 +0100
Subject: [PATCH] chore: add --provenance to allow trusted publishing to npm

---
 .github/workflows/publish.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 99fb3c5..bb9abdb 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -46,7 +46,7 @@ jobs:
       - name: Set package version
         run: yarn version --new-version "${{ steps.get_version.outputs.VERSION }}" --no-git-tag-version
       - name: Publish package
-        run: npm publish --access public --tag ${{ steps.extract_tag.outputs.NPM_TAG }}
+        run: npm publish --provenance --access public --tag ${{ steps.extract_tag.outputs.NPM_TAG }}
       - name: Push version bump
         uses: stefanzweifel/git-auto-commit-action@v4
         with: