fix: disable npm provenance for private repository #18

	name: Release

	on:
	push:
	branches:
	- main

	# OIDC Trusted Publishing - npm provenance for signed packages
	# See: https://docs.npmjs.com/generating-provenance-statements

	jobs:
	release:
	runs-on: ubuntu-latest
	permissions:
	contents: write
	issues: write
	pull-requests: write
	id-token: write # Required for OIDC trusted publishing

	steps:
	- name: Checkout
	uses: actions/checkout@v4
	with:
	fetch-depth: 0
	persist-credentials: false

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: '22'
	registry-url: 'https://registry.npmjs.org'

	- name: Install dependencies
	run: npm ci

	- name: Build plugin
	run: npm run build

	- name: Verify plugin
	run: npm run verify

	- name: Release
	env:
	GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
	NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
	# NPM_CONFIG_PROVENANCE: true # Only works with PUBLIC repos
	run: npx semantic-release

Provide feedback