twenty-sdk env var to disable prov check (#23155)

<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/pull/23155?utm_source=github"
target="_blank" rel="noopener noreferrer"
data-no-image-dialog="true"><picture><source
media="(prefers-color-scheme: dark)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"><source
media="(prefers-color-scheme: light)"
srcset="https://www.cubic.dev/buttons/review-in-cubic-light.svg"><img
alt="Review in cubic"
src="https://www.cubic.dev/buttons/review-in-cubic-dark.svg"></picture></a>
<!-- End of auto-generated description by cubic. -->

packages/twenty-sdk/src/cli/operations/publish.ts

@@ -43,7 +43,13 @@ const innerAppPublish = async (
   // Provenance can only be generated from a CI with OIDC; forcing it locally
   // makes npm publish fail. ACTIONS_ID_TOKEN_REQUEST_URL is only set when the
   // GitHub Actions workflow grants id-token: write.
-  const supportsProvenance = process.env.ACTIONS_ID_TOKEN_REQUEST_URL != null;
+  // npm rejects provenance when the workflow runs from a private source repo
+  // (E422 "Unsupported GitHub Actions source repository visibility: private").
+  // Set TWENTY_APP_PUBLISH_DISABLE_PROVENANCE=true to opt out in that case.
+  const provenanceDisabled =
+    process.env.TWENTY_APP_PUBLISH_DISABLE_PROVENANCE === 'true';
+  const supportsProvenance =
+    process.env.ACTIONS_ID_TOKEN_REQUEST_URL != null && !provenanceDisabled;
 
   const publishArgs = [
     'publish',