Repository navigation
[BUG] Unable to generate provenance from trusted publishing workflow #8558
Description
Is there an existing issue for this?
- I have searched the existing issues
This issue exists in the latest npm version
- I am using the latest npm
Current Behavior
I am publishing a package in GitLab public runners with trusted publishing. Provenance statements are not generated.
https://www.npmjs.com/package/codemirror-lang-scheme?activeTab=versions
Expected Behavior
According to the docs, provenance should be automatically added without adding the --provenance flag.
Steps To Reproduce
I've tried in several, slightly different ways, but see the pipelines logs. In particular:
The package is (AFAIK) properly configured for trusted publishing: screenshot
Environment
- npm: 11.5.1, 11.5.2, 11.6.0
- Node.js: 22.x, 24.x
- OS Name: Ubuntu
Activity
wraithgar commentedon Sep 10, 2025
Thanks for submitting that docs update. I do know we had folks using gitlab in our beta program for this, so it should work. It's entirely possible our example is in error.
fix: gitlab example for trusted publishing (#1710)
remcohaszing commentedon Nov 28, 2025
I used to publish with provenance from GitLab, as can be seen on https://www.npmjs.com/package/eslint-formatter-gitlab?activeTab=versions
After switching to OIDC for version 7.0.0, the provenance is missing. You can see on https://www.npmjs.com/search?q=eslint-formatter-gitlab that this is published using OIDC. (It would be nice if the publisher is visible in the readme and versions views by the way.)
I switched to OIDC in the following commit: https://gitlab.com/remcohaszing/eslint-formatter-gitlab/-/commit/a5b6b496009248d1f14a2f5d8edfd4920aca8762. Should I have kept the
SIGSTORE_ID_TOKEN?wraithgar commentedon Dec 1, 2025
Asked our trusted publishing folks and got a good explanation of what's going on here:
The suggestion at https://docs.npmjs.com/generating-provenance-statements#example-gitlab-ci-job has
SIGSTORE_ID_TOKEN, but https://docs.npmjs.com/trusted-publishers does not.A PR adding
SIGSTORE_ID_TOKENto the trusted-publishers entry for gitlab would be in order here.remcohaszing commentedon Dec 4, 2025
I can confirm this works. I published eslint-formatter-gitlab@7.0.1 with provenance.
jrvidal commentedon Dec 4, 2025
Same here 👍
Add provenance to GitLab OIDC example (#1800)
wraithgar commentedon Dec 4, 2025
Thanks @remcohaszing npm/documentation#1800
npm provenance: trusted publishing promised attestations, the registr…