twenty-sdk env var to disable prov check (#23155)

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/23155?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

packages/create-twenty-app/src/constants/template/github/workflows/publish.yml

@@ -45,4 +45,8 @@ jobs:
         run: yarn install --immutable
 
       - name: Publish to npm
+        # Uncomment if publishing from a private source repo: npm rejects
+        # OIDC provenance for private repos
+        # env:
+        #   TWENTY_APP_PUBLISH_DISABLE_PROVENANCE: 'true'
         run: yarn twenty app:publish

packages/twenty-docs/developers/extend/apps/operations/publishing.mdx

@@ -170,6 +170,17 @@ Publishes your app to npm with provenance when you push a version tag (e.g. `v1.
 
 On npmjs.com open your package > **Settings → Trusted Publisher** and register this repository with the `publish.yml` workflow (see the [npm trusted publishing docs](https://docs.npmjs.com/trusted-publishers)). Publishing with provenance certifies which GitHub repository built the package, which is also how you claim ownership of your app in a Twenty marketplace.
 
+<Note>
+npm only accepts provenance from **public** source repositories. If you publish from a private repo, npm rejects the OIDC provenance bundle with an `E422 ... Unsupported GitHub Actions source repository visibility: "private"` error. To publish from a private repo, opt out of provenance by setting `TWENTY_APP_PUBLISH_DISABLE_PROVENANCE: 'true'` in the publish step's `env` (a commented-out hint is included in the scaffolded `publish.yml`):
+
+```yaml filename=".github/workflows/publish.yml"
+      - name: Publish to npm
+        env:
+          TWENTY_APP_PUBLISH_DISABLE_PROVENANCE: 'true'
+        run: yarn twenty app:publish
+```
+</Note>
+
 ### Pinning the reusable actions
 
 The `ci.yml` and `cd.yml` workflows reference reusable actions at `@main`, so action updates in the `twentyhq/twenty` repo are picked up automatically. If you want deterministic builds, replace `@main` with a commit SHA or release tag on each `uses:` line.

packages/twenty-sdk/src/cli/operations/publish.ts

@@ -43,7 +43,13 @@ const innerAppPublish = async (
   // Provenance can only be generated from a CI with OIDC; forcing it locally
   // makes npm publish fail. ACTIONS_ID_TOKEN_REQUEST_URL is only set when the
   // GitHub Actions workflow grants id-token: write.
-  const supportsProvenance = process.env.ACTIONS_ID_TOKEN_REQUEST_URL != null;
+  // npm rejects provenance when the workflow runs from a private source repo
+  // (E422 "Unsupported GitHub Actions source repository visibility: private").
+  // Set TWENTY_APP_PUBLISH_DISABLE_PROVENANCE=true to opt out in that case.
+  const provenanceDisabled =
+    process.env.TWENTY_APP_PUBLISH_DISABLE_PROVENANCE === 'true';
+  const supportsProvenance =
+    process.env.ACTIONS_ID_TOKEN_REQUEST_URL != null && !provenanceDisabled;
 
   const publishArgs = [
     'publish',