fix(publish): disable provenance for platform packages via env override

NPM_CONFIG_PROVENANCE env var was overriding useProvenance=false in code.
Now explicitly sets NPM_CONFIG_PROVENANCE=false for platform packages
to prevent OIDC token expiration during large binary uploads.
This commit is contained in:
justsisyphus
2026-01-22 10:49:20 +09:00
parent a25d48a651
commit 85b7e9737c

View File

@@ -208,9 +208,10 @@ async function publishPackage(cwd: string, distTag: string | null, useProvenance
const tagArgs = distTag ? ["--tag", distTag] : []
const provenanceArgs = process.env.CI && useProvenance ? ["--provenance"] : []
const env = useProvenance ? {} : { NPM_CONFIG_PROVENANCE: "false" }
try {
await $`npm publish --access public --ignore-scripts ${provenanceArgs} ${tagArgs}`.cwd(cwd)
await $`npm publish --access public --ignore-scripts ${provenanceArgs} ${tagArgs}`.cwd(cwd).env({ ...process.env, ...env })
return { success: true }
} catch (error: any) {
const stderr = error?.stderr?.toString() || error?.message || ""