From 7c31a2a9073d5567cd82f2ad3f6a5d570c9ab1c2 Mon Sep 17 00:00:00 2001
From: yzxcj797 <yzxcj797@users.noreply.github.com>
Date: Wed, 19 Aug 2026 08:25:30 +0800
Subject: [PATCH] fix(ci): verify the provenance attestation landed after
 publishing
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

npm publish --provenance publishes cleanly WITHOUT an attestation
whenever the run's OIDC token does not satisfy npm's requirements —
a silent trust downgrade for attestation-checking installers, which
is how 0.1.5 shipped with no evidence after 0.1.0 had one (#591).

After publishing, query the registry for the version's attestations
and fail the job when none exist, turning the next silent downgrade
into a loud CI failure naming the likely cause. The check runs on
the already-published keep-path too, so an early-exit that skips
publishing still validates the version's evidence.
---
 .github/workflows/publish-cli.yml | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/.github/workflows/publish-cli.yml b/.github/workflows/publish-cli.yml
index e72eb56e..bf094945 100644
--- a/.github/workflows/publish-cli.yml
+++ b/.github/workflows/publish-cli.yml
@@ -92,6 +92,18 @@ jobs:
           else
             npm publish --provenance --access public
           fi
+          # The provenance flag only produces an attestation when the run's
+          # OIDC token satisfies npm's requirements; every other failure mode
+          # publishes cleanly WITHOUT one, silently downgrading trust for
+          # attestation-checking installers (aube/pnpm trust policies) — exactly
+          # the 0.1.5 incident (#591). Verify the attestation actually landed
+          # and fail loudly otherwise.
+          attestations=$(npm view "@yc-software/qm@$version" attestations --json 2>/dev/null || echo '[]')
+          if [ "$attestations" = 'null' ] || [ "$attestations" = '[]' ] || [ -z "$attestations" ]; then
+            echo "::error::@yc-software/qm@$version published without a provenance attestation; trust-checking installers will refuse or downgrade it. Check the run's id-token permission and republish a new version."
+            exit 1
+          fi
+          echo "@yc-software/qm@$version published with provenance attestation"
           if [ "$version" = 0.1.5 ]; then
             npm deprecate @yc-software/qm@1.0.5 "Published with an incorrect version number; use 0.1.5."
           fi