fix(release): drop provenance=true from .npmrc; CI sets it via env #16

	name: Deploy site to GitHub Pages

	on:
	push:
	branches: [main]
	paths:
	- "site/**"
	- "src/**"
	- "packages/**"
	- "package.json"
	- "pnpm-lock.yaml"
	- "pnpm-workspace.yaml"
	- ".github/workflows/deploy-site.yml"
	workflow_dispatch:

	permissions:
	contents: read
	pages: write
	id-token: write

	# Cancel an in-flight deploy if a new commit lands; never run two at once.
	concurrency:
	group: pages
	cancel-in-progress: true

	jobs:
	build:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- uses: pnpm/action-setup@v4

	- uses: actions/setup-node@v4
	with:
	node-version: 22
	cache: pnpm

	- run: pnpm install --frozen-lockfile

	# Site depends on @office-kit/docx (root) and @office-kit/docx-preview
	# via workspace:* resolutions to their built dist/index.mjs. Build those
	# two first (not the site itself — that runs below with BASE_PATH set).
	# `pnpm build` is required for the root package: `pnpm --filter` and
	# `pnpm -r` both skip the workspace-root project.
	- name: Build packages
	run: pnpm build:packages

	- name: Type-check site
	run: pnpm --filter word-kit-site check

	- name: Build site
	# If you publish to https://<user>.github.io/<repo>/ keep BASE_PATH
	# set to /<repo>. For a custom domain or user page, set BASE_PATH=''.
	env:
	BASE_PATH: /${{ github.event.repository.name }}
	run: pnpm --filter word-kit-site build

	- uses: actions/upload-pages-artifact@v3
	with:
	path: site/build

	deploy:
	needs: build
	runs-on: ubuntu-latest
	environment:
	name: github-pages
	url: ${{ steps.deployment.outputs.page_url }}
	steps:
	- id: deployment
	uses: actions/deploy-pages@v4

Provide feedback