From 3ee8b72aa3e040c129a5c62bba26540b481313cc Mon Sep 17 00:00:00 2001
From: Paul Rastoin <45004772+prastoin@users.noreply.github.com>
Date: Wed, 22 Jul 2026 11:51:06 +0200
Subject: [PATCH] twenty-sdk env var to disable prov check (#23155)

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/23155?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->
---
 .../constants/template/github/workflows/publish.yml   |  4 ++++
 .../developers/extend/apps/operations/publishing.mdx  | 11 +++++++++++
 packages/twenty-sdk/src/cli/operations/publish.ts     |  8 +++++++-
 3 files changed, 22 insertions(+), 1 deletion(-)

diff --git a/packages/create-twenty-app/src/constants/template/github/workflows/publish.yml b/packages/create-twenty-app/src/constants/template/github/workflows/publish.yml
index 5297e3598b..f6b564bee8 100644
--- a/packages/create-twenty-app/src/constants/template/github/workflows/publish.yml
+++ b/packages/create-twenty-app/src/constants/template/github/workflows/publish.yml
@@ -45,4 +45,8 @@ jobs:
         run: yarn install --immutable
 
       - name: Publish to npm
+        # Uncomment if publishing from a private source repo: npm rejects
+        # OIDC provenance for private repos
+        # env:
+        #   TWENTY_APP_PUBLISH_DISABLE_PROVENANCE: 'true'
         run: yarn twenty app:publish
diff --git a/packages/twenty-docs/developers/extend/apps/operations/publishing.mdx b/packages/twenty-docs/developers/extend/apps/operations/publishing.mdx
index 6b31f18508..2b6d7eb897 100644
--- a/packages/twenty-docs/developers/extend/apps/operations/publishing.mdx
+++ b/packages/twenty-docs/developers/extend/apps/operations/publishing.mdx
@@ -170,6 +170,17 @@ Publishes your app to npm with provenance when you push a version tag (e.g. `v1.
 
 On npmjs.com open your package > **Settings → Trusted Publisher** and register this repository with the `publish.yml` workflow (see the [npm trusted publishing docs](https://docs.npmjs.com/trusted-publishers)). Publishing with provenance certifies which GitHub repository built the package, which is also how you claim ownership of your app in a Twenty marketplace.
 
+<Note>
+npm only accepts provenance from **public** source repositories. If you publish from a private repo, npm rejects the OIDC provenance bundle with an `E422 ... Unsupported GitHub Actions source repository visibility: "private"` error. To publish from a private repo, opt out of provenance by setting `TWENTY_APP_PUBLISH_DISABLE_PROVENANCE: 'true'` in the publish step's `env` (a commented-out hint is included in the scaffolded `publish.yml`):
+
+```yaml filename=".github/workflows/publish.yml"
+      - name: Publish to npm
+        env:
+          TWENTY_APP_PUBLISH_DISABLE_PROVENANCE: 'true'
+        run: yarn twenty app:publish
+```
+</Note>
+
 ### Pinning the reusable actions
 
 The `ci.yml` and `cd.yml` workflows reference reusable actions at `@main`, so action updates in the `twentyhq/twenty` repo are picked up automatically. If you want deterministic builds, replace `@main` with a commit SHA or release tag on each `uses:` line.
diff --git a/packages/twenty-sdk/src/cli/operations/publish.ts b/packages/twenty-sdk/src/cli/operations/publish.ts
index 9e10d35090..fb09d08972 100644
--- a/packages/twenty-sdk/src/cli/operations/publish.ts
+++ b/packages/twenty-sdk/src/cli/operations/publish.ts
@@ -43,7 +43,13 @@ const innerAppPublish = async (
   // Provenance can only be generated from a CI with OIDC; forcing it locally
   // makes npm publish fail. ACTIONS_ID_TOKEN_REQUEST_URL is only set when the
   // GitHub Actions workflow grants id-token: write.
-  const supportsProvenance = process.env.ACTIONS_ID_TOKEN_REQUEST_URL != null;
+  // npm rejects provenance when the workflow runs from a private source repo
+  // (E422 "Unsupported GitHub Actions source repository visibility: private").
+  // Set TWENTY_APP_PUBLISH_DISABLE_PROVENANCE=true to opt out in that case.
+  const provenanceDisabled =
+    process.env.TWENTY_APP_PUBLISH_DISABLE_PROVENANCE === 'true';
+  const supportsProvenance =
+    process.env.ACTIONS_ID_TOKEN_REQUEST_URL != null && !provenanceDisabled;
 
   const publishArgs = [
     'publish',