feat: enable provenance in trusted environments by default

[GauBen]

What's the problem this PR addresses?

Closes #7017

How did you fix it?

Set provenance = true when all necessary env vars are defined

Checklist

• I have read the Contributing Guide.

• I have set the packages that need to be released for my changes to be effective.

• I will check that all automated PR checks pass before the PR gets reviewed.

[clemyan]

IMO, if we are to enable provenance by default (even conditionally), we need to properly support --no-provenance and npmPublishProvenance: false to override that behaviour

[Drarig29]

Hi @GauBen @clemyan! Gentle bump on this PR. While reading https://docs.npmjs.com/trusted-publishers#automatic-provenance-generation we assumed we could drop the --provenance flag when migrating to OIDC publishing with Yarn as well, but it's only the case for NPM.

In the meantime, we are going to reintroduce the --provenance flag

[arcanis]

I'm not certain we can do this - it's not documented well, but provenance publishing isn't possible from private repositories :/

https://github.blog/changelog/2023-07-25-publishing-with-npm-provenance-from-private-source-repositories-is-no-longer-supported/

Or at least we may need to replicate a check to make sure we don't apply this on private repo. How does npm do it?

[Drarig29]

Just more code to copy/paste from NPM indeed, haha 😁

• For repo visibility: https://github.com/npm/cli/blob/3474ec35fb579873d20a4b6747983ca369d61592/lib/utils/oidc.js#L152-L154
• For package visibility: https://github.com/npm/cli/blob/3474ec35fb579873d20a4b6747983ca369d61592/workspaces/libnpmaccess/lib/index.js#L49-L53