workflow: skip provenance when publishing commits

scripts/release.js

@@ -507,7 +507,8 @@ async function publishPackages(version) {
   }
   // add provenance metadata when releasing from CI
   // canary release commits are not pushed therefore we don't need to add provenance
-  if (process.env.CI && !isCanary) {
+  // also skip provenance if not publishing to actual npm
+  if (process.env.CI && !isCanary && !args.registry) {
     additionalPublishFlags.push('--provenance')
   }