[BUG] provenance is not generated when published from GitHub actions

[paulmillr]

Is there an existing issue for this?

• I have searched the existing issues

This issue exists in the latest npm version

• I am using the latest npm

Current Behavior

noble-post quantum and other packages have been using github actions to publish to npm, using provenance feature: https://github.com/paulmillr/noble-post-quantum/actions/runs/12591336568/job/35094301187

NPM package of the repo does not show the fact the latest release has been published using "verified" provenance, no checkbox
https://www.npmjs.com/package/@noble/post-quantum?activeTab=readme

[paulmillr]

I just published micro-ftch and the provenance was added correctly. The only difference in the flow is that post-quantum did npm update -g npm and micro-ftch did not.

So I think it's regression in newest npm version.

https://github.com/paulmillr/micro-ftch/actions/runs/12698324948