From 2c208e51a732780e717baf7d5eeb0d5ad85802cb Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 10 Mar 2026 21:59:32 +0000
Subject: [PATCH 1/2] Initial plan


From 2f7172a2bae18ab76cc63c5aeb2762b6e69ccfd4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 10 Mar 2026 22:03:03 +0000
Subject: [PATCH 2/2] Fix publish workflow: add NODE_AUTH_TOKEN env var and
 --provenance flag

The npm publish step was missing the NODE_AUTH_TOKEN environment variable
needed to authenticate with the npm registry. The actions/setup-node action
creates an .npmrc that references NODE_AUTH_TOKEN, but the publish step
never set it from secrets.

Also added --provenance flag since the workflow already has id-token: write
permission configured for npm provenance support.

Co-authored-by: CameronTofer <3507892+CameronTofer@users.noreply.github.com>
---
 .github/workflows/publish.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index e203577..4e272c0 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -40,4 +40,6 @@ jobs:
 
       - name: Publish to npm
         if: ${{ !inputs.dry_run }}
-        run: npm publish --access public
+        run: npm publish --access public --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}