From c5191734f1c2543729f65cff34b9b9e1cf44595c Mon Sep 17 00:00:00 2001
From: Chris Wood <chris@flipbit.co.uk>
Date: Fri, 6 Mar 2026 17:25:16 +0100
Subject: [PATCH] ci: add NPM_TOKEN for publish authentication

--provenance uses OIDC for attestation, but npm still needs a token
for publish authentication.
---
 .github/workflows/release.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 0d0fb4c..ac01df4 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -65,6 +65,8 @@ jobs:
           else
             npm publish --provenance --access public
           fi
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
   github-release:
     needs: publish