Use npm publish --provenance

Author: rwinch

.github/workflows/release.yml

@@ -20,13 +20,11 @@ jobs:
     - name: Install Node.js
       uses: actions/setup-node@v4
       with:
-        node-version: '16'
+        node-version-file: '.nvmrc'
         registry-url: 'https://registry.npmjs.org'
         cache: 'npm'
     - name: Set up release environment
       run: |
         echo RELEASE_VERSION=${{ github.event.inputs.release-version }} >> $GITHUB_ENV
     - name: Build, tag, and publish npm package
-      env:
-        NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: ./npm/release.sh

npm/release.sh

@@ -39,7 +39,7 @@ git config --local user.email "$RELEASE_GIT_EMAIL"
   git tag -m "version $RELEASE_VERSION" v$RELEASE_VERSION
   git push origin $(git describe --tags --exact-match)
   npm whoami
-  npm publish --access public --tag $RELEASE_NPM_TAG
+  npm publish --provenance --access public --tag $RELEASE_NPM_TAG
   git push origin $RELEASE_BRANCH
 )