From c2cccca8a2ae1a86eacbc2049fccd63bb0431335 Mon Sep 17 00:00:00 2001
From: Erik Onarheim <erik.onarheim@gmail.com>
Date: Fri, 26 Sep 2025 08:24:33 -0500
Subject: [PATCH] chore: enable provenance publishing

---
 .github/workflows/deploy.yml  | 8 ++++++--
 .github/workflows/release.yml | 9 ++++++---
 .npmrc                        | 3 ++-
 package.json                  | 3 +++
 4 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 3f67315f..d5cafcf3 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -5,7 +5,6 @@ on:
 
 env:
   GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
 jobs:
   build:
@@ -14,6 +13,9 @@ jobs:
     name: Publish alpha npm package
     needs: [build]
     runs-on: [ubuntu-latest]
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -30,7 +32,9 @@ jobs:
       - run: echo "alpha_version=$(node -e "console.log(require('./version').getAlphaVersion());")" >> $GITHUB_ENV
       - run: echo $alpha_version
       - run: npm --no-git-tag-version version $alpha_version
-      - run: npm publish --tag next
+      - run: npm publish --tag next --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
       - name: Create Tag
         uses: actions/github-script@v7.0.1
         with:
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 5a46612a..2b0cb79d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,8 +5,6 @@ on:
 
 env:
   release: true
-  GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
 jobs:
   build:
@@ -15,6 +13,9 @@ jobs:
     name: Publish npm package
     needs: [build]
     runs-on: [ubuntu-latest]
+    permissions:
+      contents: read
+      id-token: write
 
     steps:
       - uses: actions/checkout@v4
@@ -29,4 +30,6 @@ jobs:
       - run: npm ci
       - run: npm run build
       - run: npm run build:esm
-      - run: npm publish
+      - run: npm publish --provenance
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.npmrc b/.npmrc
index fddfd5d4..7bec050a 100644
--- a/.npmrc
+++ b/.npmrc
@@ -1,4 +1,5 @@
 registry=https://registry.npmjs.org
 save=true
 save-exact=true
-cache=node_cache
\ No newline at end of file
+cache=node_cache
+provenance=true
diff --git a/package.json b/package.json
index 173f025e..6b03378b 100644
--- a/package.json
+++ b/package.json
@@ -3,6 +3,9 @@
   "sideEffects": false,
   "version": "0.31.0",
   "exNextVersion": "0.32.0",
+  "publishConfig": {
+    "provenance": true
+  },
   "description": "Excalibur.js is a simple JavaScript game engine with TypeScript bindings for making 2D games in HTML5 Canvas. Our mission is to make web game development as simple as possible.",
   "author": "https://github.com/excaliburjs/Excalibur/graphs/contributors",
   "homepage": "https://github.com/excaliburjs/Excalibur",
-- 
2.51.2