[BUG] Unable to generate provenance from trusted publishing workflow

[jrvidal]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

I am publishing a package in GitLab public runners with trusted publishing. Provenance statements are not generated.

https://www.npmjs.com/package/codemirror-lang-scheme?activeTab=versions

Expected Behavior

According to the docs, provenance should be automatically added without adding the --provenance flag.

Steps To Reproduce

I've tried in several, slightly different ways, but see the pipelines logs. In particular:

• Test 4: job, ci config
• Test 3: job, ci config
• Test 2: job, ci config
• Test 1: job, ci config

The package is (AFAIK) properly configured for trusted publishing: screenshot

Environment

• npm: 11.5.1, 11.5.2, 11.6.0
• Node.js: 22.x, 24.x
• OS Name: Ubuntu

[wraithgar]

Thanks for submitting that docs update. I do know we had folks using gitlab in our beta program for this, so it should work. It's entirely possible our example is in error.