Automatic provenance generation not supported for provider: null

In GitHub Actions without `permissions: id-token: write` the message is 'Provenance generation in GitHub Actions requires "write" access to the "id-token" permission' (both reproduced with npm 11.19.1); in GitLab without the `id_tokens` entry it names `SIGSTORE_ID_TOKEN` (text from libnpmpublish's source). All are `EUSAGE` errors. The provider name comes from npm's CI detection (`ci-info`).

npm publish --provenance (npm 9.5+) — libnpmpublish, code EUSAGE

What it means

`npm publish --provenance` creates a signed SLSA provenance statement that says which CI workflow built the package. npm can only do that inside a supported CI system that provides an OIDC identity (GitHub Actions on GitHub-hosted runners, GitLab CI on shared runners); the identity is what Sigstore puts into the signing certificate. `provider: null` means npm detected no CI at all — the command ran on a developer machine or in an unsupported CI. Nothing was published.

Why it happens

• Publishing from a laptop

  common

  `--provenance` (or `provenance=true` in `.npmrc`, or `publishConfig.provenance`) set for a package that a maintainer publishes manually. Provenance is meant to prove a CI build, so it cannot be produced locally.

• CI job without permission to mint an OIDC token

  common

  GitHub Actions only provides the token with `id-token: write`; GitLab only with an `id_tokens` entry whose audience is `sigstore`.

• A CI system npm cannot generate provenance for

  occasional

  Jenkins, CircleCI, self-hosted runners and others are detected (the provider name appears in the message) but not supported for automatic provenance.

How to fix it

1. 1.

   Publish from a GitHub Actions workflow

   Grant `id-token: write`, run on a GitHub-hosted runner and publish with `--provenance`. npm's trusted publishing (OIDC) can replace the npm token entirely.

   name: release
   on: { release: { types: [published] } }
   permissions:
     contents: read
     id-token: write          # lets npm obtain the OIDC token Sigstore needs
   jobs:
     publish:
       runs-on: ubuntu-latest   # GitHub-hosted runner
       steps:
         - uses: actions/checkout@v4
         - uses: actions/setup-node@v4
           with: { node-version: 24, registry-url: "https://registry.npmjs.org" }
         - run: npm ci
         - run: npm publish --provenance --access public
           env: { NODE_AUTH_TOKEN: "${{ secrets.NPM_TOKEN }}" }

2. 2.

   Or from GitLab CI

   Request an ID token with the `sigstore` audience under `id_tokens`; npm picks it up from `SIGSTORE_ID_TOKEN`.

   publish:
     image: node:24
     id_tokens:
       SIGSTORE_ID_TOKEN:
         aud: sigstore
     script:
       - npm publish --provenance --access public

← Browse the full signature error database