From ee66d162f25d450ed76dd52031a2ad25fda472bc Mon Sep 17 00:00:00 2001
From: Jamie <113370520+jamiebuilds-signal@users.noreply.github.com>
Date: Mon, 13 Jul 2026 14:26:51 -0700
Subject: [PATCH] Enable trusted publishing for types package

---
 .changeset/twenty-baths-hide.md                  | 5 +++++
 danger/rules/enforcePackageJsonPublishConfig.mjs | 6 ++++--
 packages/types/package.json                      | 2 +-
 3 files changed, 10 insertions(+), 3 deletions(-)
 create mode 100644 .changeset/twenty-baths-hide.md

diff --git a/.changeset/twenty-baths-hide.md b/.changeset/twenty-baths-hide.md
new file mode 100644
index 0000000000..6f2d28af1f
--- /dev/null
+++ b/.changeset/twenty-baths-hide.md
@@ -0,0 +1,5 @@
+---
+'@signalapp/types': patch
+---
+
+Enable trusted publishing
diff --git a/danger/rules/enforcePackageJsonPublishConfig.mjs b/danger/rules/enforcePackageJsonPublishConfig.mjs
index e1f946e8cc..e7a9b0e7e0 100644
--- a/danger/rules/enforcePackageJsonPublishConfig.mjs
+++ b/danger/rules/enforcePackageJsonPublishConfig.mjs
@@ -23,7 +23,7 @@ const PackageSchema = z.discriminatedUnion(
       publishConfig: z.strictObject({
         access: z.literal('public'),
         registry: z.literal('https://registry.npmjs.org/'),
-        provenance: z.literal(true),
+        provenance: z.literal(false),
       }),
     }),
   ]
@@ -56,7 +56,9 @@ await Promise.all(
       '"publishConfig": {',
       '  "access": "public",',
       '  "registry": "https://registry.npmjs.org/",',
-      '  "provenance": true',
+      // provenance is not supported in private repos
+      // https://docs.npmjs.com/trusted-publishers#automatic-provenance-generation
+      '  "provenance": false',
       '}',
       '```',
       '',
diff --git a/packages/types/package.json b/packages/types/package.json
index 724a77a34f..bb15a703a5 100644
--- a/packages/types/package.json
+++ b/packages/types/package.json
@@ -5,7 +5,7 @@
   "publishConfig": {
     "access": "public",
     "registry": "https://registry.npmjs.org/",
-    "provenance": true
+    "provenance": false
   },
   "author": {
     "name": "Signal Messenger, LLC",