fix(scripts): disable npm provenance for private repo

[wyattjoh]

Summary

• Remove --provenance from npm publish in scripts/releaser/index.ts

Why

npm publish --provenance requires the source repository to be public. clerk/cli is currently private, so sigstore rejects publishes with E422 Unprocessable Entity. The flag is removed with a comment pointing to when it should be re-enabled: once the repo is public and OIDC trusted publishing replaces NODE_AUTH_TOKEN (see the follow-up PR in this stack).

[wyattjoh]

Stack: npm-publishing-fixes

• fix(scripts): disable npm provenance for private repo #141 👈 this PR
  • refactor(scripts): consolidate releaser into scripts/lib #134
    • chore(ci): remove NODE_AUTH_TOKEN once OIDC trusted publishing is enabled #135

Part of a stacked PR chain. Do not merge manually.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c2b3f86d-635e-4849-b94e-780b50a568d2

📥 Commits

Reviewing files that changed from the base of the PR and between f9be436 and 9fe336e.

📒 Files selected for processing (1)

• scripts/releaser/index.ts

---

📝 Walkthrough

Walkthrough

The publish() function in scripts/releaser/index.ts was modified to remove the --provenance flag from the npm publish command invocation. All other npm publish arguments remain unchanged, including --access public, --ignore-scripts, optional --tag specification, and --dry-run mode. No public or exported entity signatures were altered.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~3 minutes

🚥 Pre-merge checks | ✅ 2 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (2 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: disabling npm provenance in the publishing script due to private repository constraints.
Description check	✅ Passed	The description clearly explains the change, provides rationale for the fix, and references follow-up work needed when the repository becomes public.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}