From 91da5a3fa7433fea0fcc4244e13ed38d8b2ead37 Mon Sep 17 00:00:00 2001
From: Kieran Osgood <kieran.osgood@shopify.com>
Date: Wed, 26 Aug 2026 18:08:01 +0100
Subject: [PATCH] Fix npm trusted publishing

Assisted-By: devx/414037a7-8b00-4d1b-b4ff-20c6919aa6df
---
 .github/workflows/publish.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
index 6aca1984..e2e20db3 100644
--- a/.github/workflows/publish.yml
+++ b/.github/workflows/publish.yml
@@ -41,6 +41,9 @@ jobs:
           pnpm module clean
           pnpm module build
           cd modules/@shopify/checkout-sheet-kit
-          npm publish --access public --tag ${{ steps.npm-tag.outputs.tag }}
+          pnpm dlx npm@11.5.1 publish --no-git-checks --ignore-scripts --access public --tag "$NPM_TAG" --provenance
         env:
-          NPM_TOKEN: '' # Empty string forces OIDC
+          NPM_TAG: ${{ steps.npm-tag.outputs.tag }}
+          NPM_CONFIG_PROVENANCE: "true"
+          NPM_TOKEN: ""
+          NODE_AUTH_TOKEN: ""