Verify npm provenance attestations on the next release

[djacu]

Context

@nixos/branding is configured for npm trusted publishing (OIDC): the trusted publisher on npmjs names repo nixos/branding / workflow release-guide.yml, and id-token: write is granted on both the caller job (release-npm-package in release-guide.yml) and the child job (build-npm-package in release-npm-package.yaml). Per npm's docs, trusted publishing from a public repo auto-generates provenance attestations — no --provenance flag needed — and for reusable workflows the trusted publisher must name the top-level workflow (which it does).

The currently published versions (0.0.1, 0.1.0, Nov 2025) have no provenance attestations, but they were published manually before the release workflow was functional (the media-kit build was broken until #59), so they predate the working automated path.

To verify on the next release

When the next release is cut through the automated pipeline (tag nixos-branding-guide-v*.*.*):

• The release-npm-package job authenticated via OIDC (no token) and published successfully.
• The new version shows a provenance attestation — the "Provenance" section on https://www.npmjs.com/package/@nixos/branding, or the version's dist.attestations field at https://registry.npmjs.org/@nixos/branding.

If provenance is absent despite a successful trusted-publishing run, add --provenance to the npm publish command in release-npm-package.yaml as an explicit fallback.

References

• npm trusted publishing (auto-provenance + reusable-workflow rules): https://docs.npmjs.com/trusted-publishers
• Workflow-security hardening: Pin GitHub Actions to commit SHAs #55, Harden workflows: env-var PR refs and disable checkout credential persistence #58, Fix release: build release-assets and publish via gh CLI #59, Scope workflow GITHUB_TOKEN permissions per job #60, Add workflow-security CI gate (zizmor + pinact) and Dependabot cooldown #61, Resolve zizmor --pedantic findings and add report-only pedantic audit #62