Restore npm provenance (3.0.3)

.changeset/warm-eagles-share.md

@@ -0,0 +1,10 @@
+---
+'confluence.js': patch
+---
+
+Restore the npm provenance attestation.
+
+3.0.2 was published without one: the release switched to `changeset publish`, which delegates to pnpm's native publish,
+and pnpm reads the provenance flag from `.npmrc` rather than the `NPM_CONFIG_PROVENANCE` env var the workflow was
+setting. This release turns provenance on in `.npmrc`, so the published package is signed again — the same SLSA
+attestation 3.0.1 carried. No code changes; the package contents are identical to 3.0.2.

.github/workflows/release.yml

@@ -61,9 +61,11 @@ jobs:
       #   - it prints the `New tag:` lines the action greps to learn what shipped, so
       #     the action tags the actual release commit and cuts the GitHub release —
       #     `pnpm publish` prints neither, which is why v3.0.0 had to be tagged by hand.
-      # Provenance is preserved via NPM_CONFIG_PROVENANCE: `changeset publish` shells
-      # out to `pnpm publish`, which reads it as `--provenance` (needs id-token: write,
-      # granted above).
+      # Provenance is switched on in .npmrc (`provenance=true`), not here: `changeset
+      # publish` delegates to pnpm 11's native publish, which reads .npmrc but ignores
+      # the NPM_CONFIG_* env prefix (its own is PNPM_CONFIG_*) — 3.0.2 shipped without
+      # an attestation because the env var never reached it. id-token: write, granted
+      # above, is what lets the OIDC-authenticated publish sign the attestation.
       - name: 📦 Create Release PR or Publish
         id: changesets
         uses: changesets/action@v1
@@ -76,4 +78,3 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-          NPM_CONFIG_PROVENANCE: 'true'

.npmrc

@@ -1 +1,5 @@
 registry=https://registry.npmjs.org/
+# Provenance for the release publish. pnpm 11's native publish reads this from
+# .npmrc; it does NOT honour the NPM_CONFIG_PROVENANCE env var (that prefix is npm's,
+# pnpm's is PNPM_CONFIG_*), which is why 3.0.2 shipped without an attestation.
+provenance=true