@principles/core 1.286.0 → 1.287.0

package/dist/runtime-v2/__tests__/architecture-regression.test.js

@@ -3523,10 +3523,21 @@ describe('SEC-BASE-1: supply chain provenance guards', () => {
             return null;
         }
     }
-    it('publish-npm.yml uses --provenance', () => {
-        const content = readWorkflow('publish-npm.yml');
-        expect(content, 'publish-npm.yml should exist').not.toBeNull();
-        expect(content).toMatch(/npm\s+publish\s+--provenance/);
+    it('publish surface uses --provenance', () => {
+        // Changesets cutover (SPEC v1.2): the per-package npm publish command
+        // moved from publish-npm.yml into the shared action the train calls —
+        // the invariant spans the whole publish surface.
+        const workflow = readWorkflow('publish-npm.yml');
+        expect(workflow, 'publish-npm.yml should exist').not.toBeNull();
+        const actionPath = pathSync.join(REPO_ROOT, '.github', 'actions', 'publish-npm-package', 'action.yml');
+        let action = '';
+        try {
+            action = fsSync.readFileSync(actionPath, 'utf8');
+        }
+        catch {
+            action = '';
+        }
+        expect(`${workflow}\n${action}`).toMatch(/npm\s+publish\s+--provenance/);
     });
     it('publish-npm.yml uses npm ci --ignore-scripts', () => {
         const content = readWorkflow('publish-npm.yml');