Verify npm provenance attestations on the next release

Context

@nixos/branding is configured for npm trusted publishing (OIDC): the trusted publisher on npmjs names repo nixos/branding / workflow release-guide.yml, and id-token: write is granted on both the caller job (release-npm-package in release-guide.yml) and the child job (build-npm-package in release-npm-package.yaml). Per npm's docs, trusted publishing from a public repo auto-generates provenance attestations — no --provenance flag needed — and for reusable workflows the trusted publisher must name the top-level workflow (which it does).

The currently published versions (0.0.1, 0.1.0, Nov 2025) have no provenance attestations, but they were published manually before the release workflow was functional (the media-kit build was broken until #59), so they predate the working automated path.

To verify on the next release

When the next release is cut through the automated pipeline (tag nixos-branding-guide-v*.*.*):

• The release-npm-package job authenticated via OIDC (no token) and published successfully.
• The new version shows a provenance attestation — the "Provenance" section on https://www.npmjs.com/package/@nixos/branding, or the version's dist.attestations field at https://registry.npmjs.org/@nixos/branding.

If provenance is absent despite a successful trusted-publishing run, add --provenance to the npm publish command in release-npm-package.yaml as an explicit fallback.

References

• npm trusted publishing (auto-provenance + reusable-workflow rules): https://docs.npmjs.com/trusted-publishers
• Workflow-security hardening: #55, #58, #59, #60, #61, #62

Start with release-guide.yml and release-npm-package.yaml, then follow the next tag matching nixos-branding-guide-v*.. through the automated release. Confirm OIDC publishing succeeds without a token and inspect the npm package Provenance section or dist.attestations field. If the attestation is absent, add the explicitly requested fallback and verify the next release again.