fix: npm publish provenance permissions (#48757)

Co-authored-by: Jiachi Liu <inbox@huozhi.im>
Co-authored-by: kodiakhq[bot] <49736102+kodiakhq[bot]@users.noreply.github.com>

.github/workflows/build_test_deploy.yml

@@ -966,6 +966,9 @@ jobs:
       - build
       - build-wasm
       - build-native
+    permissions:
+      contents: write
+      id-token: write
     env:
       NPM_TOKEN: ${{ secrets.NPM_TOKEN_ELEVATED }}
     steps:
@@ -997,6 +1000,7 @@ jobs:
           name: wasm-binaries
           path: packages/next-swc/crates/wasm
 
+      - run: npm i -g npm@9 # need latest version for provenance
       - run: npm i -g pnpm@${PNPM_VERSION}
       - run: echo "//registry.npmjs.org/:_authToken=$NPM_TOKEN" >> ~/.npmrc
       - run: ./scripts/publish-native.js

.npmrc

@@ -1,3 +1,4 @@
+provenance = true
 save-exact = true
 tag-version-prefix=""
 strict-peer-dependencies = false