Enable trusted publishing for types package

.changeset/twenty-baths-hide.md

@@ -0,0 +1,5 @@
+---
+'@signalapp/types': patch
+---
+
+Enable trusted publishing

danger/rules/enforcePackageJsonPublishConfig.mjs

@@ -23,7 +23,7 @@ const PackageSchema = z.discriminatedUnion(
       publishConfig: z.strictObject({
         access: z.literal('public'),
         registry: z.literal('https://registry.npmjs.org/'),
-        provenance: z.literal(true),
+        provenance: z.literal(false),
       }),
     }),
   ]
@@ -56,7 +56,9 @@ await Promise.all(
       '"publishConfig": {',
       '  "access": "public",',
       '  "registry": "https://registry.npmjs.org/",',
-      '  "provenance": true',
+      // provenance is not supported in private repos
+      // https://docs.npmjs.com/trusted-publishers#automatic-provenance-generation
+      '  "provenance": false',
       '}',
       '```',
       '',

packages/types/package.json

@@ -5,7 +5,7 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/",
-    "provenance": true
+    "provenance": false
   },
   "author": {
     "name": "Signal Messenger, LLC",