From 9fd0060aaea2674bacb81c31c9e6a141d85fe5ee Mon Sep 17 00:00:00 2001
From: Minsu Lee <minsu.lee@pleaseai.dev>
Date: Sat, 27 Jun 2026 22:14:37 +0900
Subject: [PATCH] fix(ci): publish to npm with provenance instead of bun
 publish
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The npm-publish job used `bun publish`, which fails auth here (404 on the
scoped package) and cannot emit npm provenance — contrary to the repo standard.

- publish via `npm publish --provenance` from a `bun pm pack` tarball
- add actions/setup-node (registry auth) and job-level `id-token: write` for
  OIDC provenance
- add the required `repository` field to package.json (provenance needs it)
- add a workflow_dispatch trigger so an already-tagged release (v0.3.0) can be
  (re)published manually
---
 .github/workflows/release-please.yml | 29 ++++++++++++++++++++++++----
 package.json                         |  4 ++++
 2 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml
index c2e1e0f..fe9937d 100644
--- a/.github/workflows/release-please.yml
+++ b/.github/workflows/release-please.yml
@@ -4,6 +4,11 @@ on:
   push:
     branches:
       - main
+  workflow_dispatch:
+    inputs:
+      ref:
+        description: Git tag to publish (e.g. v0.3.0) when re-running a release
+        required: true
 
 permissions:
   contents: write
@@ -31,15 +36,26 @@ jobs:
 
   npm-publish:
     needs: release-please
-    if: ${{ needs.release-please.outputs.release_created }}
+    # Publish on a fresh release, or manually for a given tag via workflow_dispatch.
+    if: ${{ needs.release-please.outputs.release_created || github.event_name == 'workflow_dispatch' }}
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write # required for npm provenance (OIDC)
     steps:
       - uses: actions/checkout@v4
+        with:
+          ref: ${{ github.event.inputs.ref || github.ref }}
 
       - uses: oven-sh/setup-bun@v2
         with:
           bun-version: latest
 
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 22
+          registry-url: https://registry.npmjs.org
+
       - name: Cache Bun dependencies
         uses: actions/cache@v4
         with:
@@ -54,7 +70,12 @@ jobs:
       - name: Build
         run: bun run build
 
-      - name: Publish to npm
-        run: bun publish
+      # bun publish does not support npm provenance; build the tarball with bun
+      # and publish it via npm with --provenance (id-token: write enables OIDC).
+      - name: Pack tarball
+        run: bun pm pack
+
+      - name: Publish to npm (with provenance)
+        run: npm publish ./*.tgz --provenance --access public
         env:
-          NPM_CONFIG_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/package.json b/package.json
index 6b848d3..becb816 100644
--- a/package.json
+++ b/package.json
@@ -6,6 +6,10 @@
   "description": "Shared CLI utilities for LLM-focused command-line tools",
   "author": "PleaseAI",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pleaseai/cli-toolkit.git"
+  },
   "keywords": [
     "cli",
     "toolkit",