From db0d9ddd3d357b5ce272f78ccb1777f559d34b80 Mon Sep 17 00:00:00 2001 From: Caian Ertl Date: Fri, 3 Jul 2026 21:40:09 -0300 Subject: [PATCH] ci(node): run npm publish on a github-hosted runner for provenance npm only issues provenance attestations on GitHub-hosted runners, and Blacksmith is self-hosted (publish failed with E422). Move just the publish job to ubuntu-latest (free on public repos) while the build matrix stays on Blacksmith, so `@c3-oss/codexcw` publishes with provenance. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/release-npm.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-npm.yml b/.github/workflows/release-npm.yml index c28e7f7..1fdd16f 100644 --- a/.github/workflows/release-npm.yml +++ b/.github/workflows/release-npm.yml @@ -71,7 +71,10 @@ jobs: name: publish needs: build if: startsWith(github.ref, 'refs/tags/node-v') - runs-on: blacksmith-2vcpu-ubuntu-2404 + # npm provenance is only issued on GitHub-hosted runners; Blacksmith is + # self-hosted. The heavy build matrix stays on Blacksmith; this small + # publish job runs github-hosted (free on public repos) to keep provenance. + runs-on: ubuntu-latest steps: - name: Checkout uses: actions/checkout@v7