From ca90e340076ea46e3fa84a010242d82217457c7b Mon Sep 17 00:00:00 2001
From: Ben Papillon <benpapillon@gmail.com>
Date: Sat, 5 Sep 2026 00:30:16 -0700
Subject: [PATCH] chore(ci): publish without provenance attestation

---
 .github/workflows/ci.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 1495830d..61dcb6e2 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -151,6 +151,12 @@ jobs:
         run: yarn build
 
       - name: Publish to npm
+        env:
+          # No provenance attestation: npm checks package.json's repository.url
+          # against the OIDC claim byte for byte, and Fern writes the org as
+          # lowercase "schematichq" while GitHub reports "SchematicHQ". OIDC
+          # auth itself does not depend on it (schematic-js does the same).
+          NPM_CONFIG_PROVENANCE: "false"
         run: |
           publish() {  # use latest npm to ensure OIDC support
             npx -y npm@latest publish "$@"