From 3628988e0dc9408ade874b71c69294233cc43d88 Mon Sep 17 00:00:00 2001
From: Felix Schneider <99918022+trueberryless@users.noreply.github.com>
Date: Sat, 31 Oct 2026 14:48:33 +0100
Subject: [PATCH 1/3] fix(ui): use distinct provenance and trusted publishing
 icons

---
 app/components/DepsStats/DependencyList.vue   |  2 +-
 app/components/Package/Card.vue               |  4 +-
 app/components/Package/Dependencies.vue       |  2 +-
 app/components/Package/Header.vue             |  2 +-
 app/components/PackageProvenanceSection.vue   |  2 +-
 app/components/ProvenanceBadge.vue            | 21 +++----
 .../TrustedPublishingBadge.stories.ts         | 50 +++++++++++++++++
 app/components/TrustedPublishingBadge.vue     | 55 +++++++++++++++++++
 app/utils/ci-providers.ts                     | 12 ++++
 i18n/locales/en.json                          |  5 ++
 i18n/schema.json                              | 15 +++++
 test/nuxt/a11y.spec.ts                        | 47 ++++++++++++++++
 12 files changed, 200 insertions(+), 17 deletions(-)
 create mode 100644 app/components/TrustedPublishingBadge.stories.ts
 create mode 100644 app/components/TrustedPublishingBadge.vue
 create mode 100644 app/utils/ci-providers.ts

diff --git a/app/components/DepsStats/DependencyList.vue b/app/components/DepsStats/DependencyList.vue
index eb6251721a..4fb78be50d 100644
--- a/app/components/DepsStats/DependencyList.vue
+++ b/app/components/DepsStats/DependencyList.vue
@@ -241,7 +241,7 @@ useIntersectionObserver(
                       count: getVulnerableInfo(dep)!.counts.total,
                     })
                   "
-                  classicon="i-lucide:shield-check"
+                  classicon="i-lucide:shield-alert"
                 />
                 <LinkBase
                   v-if="getDeprecatedInfo(dep)"
diff --git a/app/components/Package/Card.vue b/app/components/Package/Card.vue
index 6550a4ceef..76754a6dfa 100644
--- a/app/components/Package/Card.vue
+++ b/app/components/Package/Card.vue
@@ -78,11 +78,9 @@ const numberFormatter = useNumberFormatter()
       <span v-html="pkgDescription" />
     </p>
     <div class="flex flex-wrap items-center gap-x-3 sm:gap-x-4 gap-y-2 text-xs text-fg-muted">
-      <ProvenanceBadge
+      <TrustedPublishingBadge
         v-if="result.package.publisher?.trustedPublisher"
         :provider="result.package.publisher.trustedPublisher.id"
-        :package-name="result.package.name"
-        :version="result.package.version"
         :linked="false"
         compact
       />
diff --git a/app/components/Package/Dependencies.vue b/app/components/Package/Dependencies.vue
index 35657daadb..939ab57ca8 100644
--- a/app/components/Package/Dependencies.vue
+++ b/app/components/Package/Dependencies.vue
@@ -215,7 +215,7 @@ const numberFormatter = useNumberFormatter()
                   count: getVulnerableDepInfo(resolveDepName(dep, version))!.counts.total,
                 })
               "
-              classicon="i-lucide:shield-check"
+              classicon="i-lucide:shield-alert"
             />
             <LinkBase
               v-if="getDeprecatedDepInfo(resolveDepName(dep, version))"
diff --git a/app/components/Package/Header.vue b/app/components/Package/Header.vue
index 7fae62c643..256c5d6f4f 100644
--- a/app/components/Package/Header.vue
+++ b/app/components/Package/Header.vue
@@ -316,7 +316,7 @@ useShortcuts({
                 variant="button-secondary"
                 :to="packageRoute(packageName, resolvedVersion, '#provenance')"
                 :aria-label="$t('package.provenance_section.view_more_details')"
-                classicon="i-lucide:shield-check"
+                classicon="i-lucide:fingerprint"
                 class="py-1.25 px-2 me-2"
               />
             </TooltipApp>
diff --git a/app/components/PackageProvenanceSection.vue b/app/components/PackageProvenanceSection.vue
index 14c9b310c3..e78a73c82f 100644
--- a/app/components/PackageProvenanceSection.vue
+++ b/app/components/PackageProvenanceSection.vue
@@ -16,7 +16,7 @@ defineProps<{
       <div class="space-y-1">
         <p class="flex items-start gap-2 text-sm text-fg m-0">
           <span
-            class="i-lucide:shield-check w-4 h-4 shrink-0 text-emerald-500 mt-0.5"
+            class="i-lucide:fingerprint w-4 h-4 shrink-0 text-emerald-500 mt-0.5"
             aria-hidden="true"
           />
           <i18n-t keypath="package.provenance_section.built_and_signed_on" tag="span">
diff --git a/app/components/ProvenanceBadge.vue b/app/components/ProvenanceBadge.vue
index 08e91bc4e2..6ab4155bbc 100644
--- a/app/components/ProvenanceBadge.vue
+++ b/app/components/ProvenanceBadge.vue
@@ -12,16 +12,9 @@ const props = defineProps<{
   linked?: boolean
 }>()
 
-const providerLabels: Record<string, string> = {
-  github: 'GitHub Actions',
-  gitlab: 'GitLab CI',
-}
-
 const title = computed(() =>
   props.provider
-    ? $t('badges.provenance.verified_via', {
-        provider: providerLabels[props.provider] ?? props.provider,
-      })
+    ? $t('badges.provenance.verified_via', { provider: getCiProviderLabel(props.provider) })
     : $t('badges.provenance.verified_title'),
 )
 </script>
@@ -35,7 +28,11 @@ const title = computed(() =>
     class="inline-flex items-center justify-center gap-1 text-xs font-mono text-fg-muted hover:text-fg transition-colors duration-200 min-w-6 min-h-6"
     :title="title"
   >
-    <span class="i-lucide:shield-check shrink-0" :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'" />
+    <span
+      class="i-lucide:fingerprint shrink-0"
+      :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'"
+      aria-hidden="true"
+    />
     <span v-if="!compact" class="sr-only sm:not-sr-only">{{
       $t('badges.provenance.verified')
     }}</span>
@@ -45,7 +42,11 @@ const title = computed(() =>
     class="inline-flex items-center gap-1 text-xs font-mono text-fg-muted"
     :title="title"
   >
-    <span class="i-lucide:shield-check shrink-0" :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'" />
+    <span
+      class="i-lucide:fingerprint shrink-0"
+      :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'"
+      aria-hidden="true"
+    />
     <span v-if="!compact" class="sr-only sm:not-sr-only">{{
       $t('badges.provenance.verified')
     }}</span>
diff --git a/app/components/TrustedPublishingBadge.stories.ts b/app/components/TrustedPublishingBadge.stories.ts
new file mode 100644
index 0000000000..ca91ad68f4
--- /dev/null
+++ b/app/components/TrustedPublishingBadge.stories.ts
@@ -0,0 +1,50 @@
+import type { Meta, StoryObj } from '@storybook-vue/nuxt'
+import TrustedPublishingBadge from './TrustedPublishingBadge.vue'
+
+const meta = {
+  component: TrustedPublishingBadge,
+  tags: ['autodocs'],
+  argTypes: {
+    provider: {
+      control: 'select',
+      options: ['github', 'gitlab', undefined],
+    },
+  },
+  args: {
+    provider: 'github',
+  },
+} satisfies Meta<typeof TrustedPublishingBadge>
+
+export default meta
+type Story = StoryObj<typeof meta>
+
+/** Links to the npm trusted publishing docs. */
+export const Default: Story = {}
+
+/** Icon-only variant for tight spaces, as used on search result cards. */
+export const Compact: Story = {
+  args: {
+    compact: true,
+  },
+}
+
+/** Published from GitLab CI rather than GitHub Actions. */
+export const GitLab: Story = {
+  args: {
+    provider: 'gitlab',
+  },
+}
+
+/** Rendered as static text (no link) when `linked` is false. */
+export const NotLinked: Story = {
+  args: {
+    linked: false,
+  },
+}
+
+/** Without a provider, it shows a generic title. */
+export const NoProvider: Story = {
+  args: {
+    provider: undefined,
+  },
+}
diff --git a/app/components/TrustedPublishingBadge.vue b/app/components/TrustedPublishingBadge.vue
new file mode 100644
index 0000000000..3a7e2ef548
--- /dev/null
+++ b/app/components/TrustedPublishingBadge.vue
@@ -0,0 +1,55 @@
+<script setup lang="ts">
+const props = withDefaults(
+  defineProps<{
+    /** Provider ID (e.g., "github", "gitlab") */
+    provider?: string
+    /** Whether to show as compact (icon only) or full (with text) */
+    compact?: boolean
+    /** Whether to render as a link to the npm trusted publishing docs */
+    linked?: boolean
+  }>(),
+  { linked: true },
+)
+
+const trustedPublishingDocs = 'https://docs.npmjs.com/trusted-publishers'
+
+const title = computed(() =>
+  props.provider
+    ? $t('badges.trusted_publishing.title_via', { provider: getCiProviderLabel(props.provider) })
+    : $t('badges.trusted_publishing.title'),
+)
+</script>
+
+<template>
+  <a
+    v-if="props.linked !== false"
+    :href="trustedPublishingDocs"
+    target="_blank"
+    rel="noopener noreferrer"
+    class="inline-flex items-center justify-center gap-1 text-xs font-mono text-fg-muted hover:text-fg transition-colors duration-200 min-w-6 min-h-6"
+    :title="title"
+  >
+    <span
+      class="i-lucide:shield-check shrink-0"
+      :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'"
+      aria-hidden="true"
+    />
+    <span v-if="!compact" class="sr-only sm:not-sr-only">
+      {{ $t('badges.trusted_publishing.label') }}
+    </span>
+  </a>
+  <span
+    v-else
+    class="inline-flex items-center gap-1 text-xs font-mono text-fg-muted"
+    :title="title"
+  >
+    <span
+      class="i-lucide:shield-check shrink-0"
+      :class="compact ? 'w-3.5 h-3.5' : 'w-4 h-4'"
+      aria-hidden="true"
+    />
+    <span v-if="!compact" class="sr-only sm:not-sr-only">
+      {{ $t('badges.trusted_publishing.label') }}
+    </span>
+  </span>
+</template>
diff --git a/app/utils/ci-providers.ts b/app/utils/ci-providers.ts
new file mode 100644
index 0000000000..189e30f29a
--- /dev/null
+++ b/app/utils/ci-providers.ts
@@ -0,0 +1,12 @@
+const CI_PROVIDER_LABELS: Record<string, string> = {
+  github: 'GitHub Actions',
+  gitlab: 'GitLab CI',
+}
+
+/**
+ * Returns a human-readable label for a CI provider ID (e.g. "github" → "GitHub Actions"),
+ * falling back to the ID itself for unknown providers.
+ */
+export function getCiProviderLabel(provider: string): string {
+  return CI_PROVIDER_LABELS[provider] ?? provider
+}
diff --git a/i18n/locales/en.json b/i18n/locales/en.json
index ee070294cf..f19a56f034 100644
--- a/i18n/locales/en.json
+++ b/i18n/locales/en.json
@@ -1194,6 +1194,11 @@
       "label": "staged publish",
       "title": "Published through staged publishing with 2FA approval"
     },
+    "trusted_publishing": {
+      "label": "trusted publishing",
+      "title": "Published with trusted publishing",
+      "title_via": "Published with trusted publishing via {provider}"
+    },
     "jsr": {
       "title": "also available on JSR"
     }
diff --git a/i18n/schema.json b/i18n/schema.json
index 47a18e0912..cb164c0f90 100644
--- a/i18n/schema.json
+++ b/i18n/schema.json
@@ -3586,6 +3586,21 @@
           },
           "additionalProperties": false
         },
+        "trusted_publishing": {
+          "type": "object",
+          "properties": {
+            "label": {
+              "type": "string"
+            },
+            "title": {
+              "type": "string"
+            },
+            "title_via": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        },
         "jsr": {
           "type": "object",
           "properties": {
diff --git a/test/nuxt/a11y.spec.ts b/test/nuxt/a11y.spec.ts
index d2ce8a0804..c5b2833bf6 100644
--- a/test/nuxt/a11y.spec.ts
+++ b/test/nuxt/a11y.spec.ts
@@ -302,6 +302,7 @@ import {
   ProgressBar,
   ProvenanceBadge,
   StagedPublishBadge,
+  TrustedPublishingBadge,
   Readme,
   ReadmeTocDropdown,
   SearchProviderToggle,
@@ -1105,6 +1106,32 @@ describe('component accessibility audits', () => {
     })
   })
 
+  describe('TrustedPublishingBadge', () => {
+    it('should have no accessibility violations with link', async () => {
+      const component = await mountSuspended(TrustedPublishingBadge, {
+        props: { provider: 'github' },
+      })
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
+
+    it('should have no accessibility violations without link', async () => {
+      const component = await mountSuspended(TrustedPublishingBadge, {
+        props: { provider: 'github', linked: false },
+      })
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
+
+    it('should have no accessibility violations in compact mode', async () => {
+      const component = await mountSuspended(TrustedPublishingBadge, {
+        props: { compact: true },
+      })
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
+  })
+
   describe('PackageSkeleton', () => {
     it('should have no accessibility violations', async () => {
       const component = await mountSuspended(PackageSkeleton)
@@ -1217,6 +1244,22 @@ describe('component accessibility audits', () => {
       const results = await runAxe(component)
       expect(results.violations).toEqual([])
     })
+
+    it('should have no accessibility violations with a trusted publisher', async () => {
+      const component = await mountSuspended(PackageCard, {
+        props: {
+          result: {
+            ...mockResult,
+            package: {
+              ...mockResult.package,
+              publisher: { ...mockResult.package.publisher, trustedPublisher: { id: 'github' } },
+            },
+          },
+        },
+      })
+      const results = await runAxe(component)
+      expect(results.violations).toEqual([])
+    })
   })
 
   describe('PackageLikeCard', () => {
@@ -5158,6 +5201,10 @@ describe('background theme accessibility', () => {
           props: { provider: 'github', packageName: 'vue', version: '3.0.0' },
         }),
     },
+    {
+      name: 'TrustedPublishingBadge',
+      mount: () => mountSuspended(TrustedPublishingBadge, { props: { provider: 'github' } }),
+    },
     {
       name: 'LicenseDisplay',
       mount: () => mountSuspended(LicenseDisplay, { props: { license: 'MIT' } }),

From 635e9622554af2be6ca8f5f4952dc3a63b70da6f Mon Sep 17 00:00:00 2001
From: Felix Schneider <99918022+trueberryless@users.noreply.github.com>
Date: Sat, 31 Oct 2026 15:14:48 +0100
Subject: [PATCH 2/3] refactor: remove unused provenance provider label

---
 app/components/ProvenanceBadge.stories.ts | 21 ---------------------
 app/components/ProvenanceBadge.vue        | 14 +++-----------
 app/components/TrustedPublishingBadge.vue |  9 ++++++++-
 app/utils/ci-providers.ts                 | 12 ------------
 i18n/locales/ar.json                      |  3 +--
 i18n/locales/az-AZ.json                   |  3 +--
 i18n/locales/bg-BG.json                   |  3 +--
 i18n/locales/bn-IN.json                   |  3 +--
 i18n/locales/cs-CZ.json                   |  3 +--
 i18n/locales/de.json                      |  3 +--
 i18n/locales/en.json                      |  3 +--
 i18n/locales/es.json                      |  3 +--
 i18n/locales/fr-FR.json                   |  3 +--
 i18n/locales/hi-IN.json                   |  3 +--
 i18n/locales/hu-HU.json                   |  3 +--
 i18n/locales/id-ID.json                   |  3 +--
 i18n/locales/it-IT.json                   |  3 +--
 i18n/locales/ja-JP.json                   |  3 +--
 i18n/locales/kn-IN.json                   |  3 +--
 i18n/locales/ko-KR.json                   |  3 +--
 i18n/locales/mr-IN.json                   |  3 +--
 i18n/locales/nb-NO.json                   |  3 +--
 i18n/locales/ne-NP.json                   |  3 +--
 i18n/locales/nl.json                      |  3 +--
 i18n/locales/pl-PL.json                   |  3 +--
 i18n/locales/pt-BR.json                   |  3 +--
 i18n/locales/pt-PT.json                   |  3 +--
 i18n/locales/ro-RO.json                   |  3 +--
 i18n/locales/ru-RU.json                   |  3 +--
 i18n/locales/sr-Latn-RS.json              |  3 +--
 i18n/locales/ta-IN.json                   |  3 +--
 i18n/locales/te-IN.json                   |  3 +--
 i18n/locales/tr-TR.json                   |  3 +--
 i18n/locales/uk-UA.json                   |  3 +--
 i18n/locales/vi-VN.json                   |  3 +--
 i18n/locales/zh-CN.json                   |  3 +--
 i18n/locales/zh-TW.json                   |  3 +--
 i18n/schema.json                          |  3 ---
 test/nuxt/a11y.spec.ts                    |  4 +---
 39 files changed, 45 insertions(+), 117 deletions(-)
 delete mode 100644 app/utils/ci-providers.ts

diff --git a/app/components/ProvenanceBadge.stories.ts b/app/components/ProvenanceBadge.stories.ts
index 973e55db12..4363f6e754 100644
--- a/app/components/ProvenanceBadge.stories.ts
+++ b/app/components/ProvenanceBadge.stories.ts
@@ -4,14 +4,7 @@ import ProvenanceBadge from './ProvenanceBadge.vue'
 const meta = {
   component: ProvenanceBadge,
   tags: ['autodocs'],
-  argTypes: {
-    provider: {
-      control: 'select',
-      options: ['github', 'gitlab', undefined],
-    },
-  },
   args: {
-    provider: 'github',
     packageName: 'example-package',
     version: '1.0.0',
   },
@@ -30,23 +23,9 @@ export const Compact: Story = {
   },
 }
 
-/** Built on GitLab CI rather than GitHub Actions. */
-export const GitLab: Story = {
-  args: {
-    provider: 'gitlab',
-  },
-}
-
 /** Rendered as static text (no link) when `linked` is false. */
 export const NotLinked: Story = {
   args: {
     linked: false,
   },
 }
-
-/** Without a provider, it shows a generic "verified" title. */
-export const NoProvider: Story = {
-  args: {
-    provider: undefined,
-  },
-}
diff --git a/app/components/ProvenanceBadge.vue b/app/components/ProvenanceBadge.vue
index 6ab4155bbc..0a26af8b24 100644
--- a/app/components/ProvenanceBadge.vue
+++ b/app/components/ProvenanceBadge.vue
@@ -1,7 +1,5 @@
 <script setup lang="ts">
-const props = defineProps<{
-  /** Provider ID (e.g., "github", "gitlab") */
-  provider?: string
+defineProps<{
   /** Package name for linking to npmjs.com provenance page */
   packageName?: string
   /** Package version for linking */
@@ -11,12 +9,6 @@ const props = defineProps<{
   /** Whether to render as a link (defaults to true when packageName and version are provided) */
   linked?: boolean
 }>()
-
-const title = computed(() =>
-  props.provider
-    ? $t('badges.provenance.verified_via', { provider: getCiProviderLabel(props.provider) })
-    : $t('badges.provenance.verified_title'),
-)
 </script>
 
 <template>
@@ -26,7 +18,7 @@ const title = computed(() =>
     target="_blank"
     rel="noopener noreferrer"
     class="inline-flex items-center justify-center gap-1 text-xs font-mono text-fg-muted hover:text-fg transition-colors duration-200 min-w-6 min-h-6"
-    :title="title"
+    :title="$t('badges.provenance.verified_title')"
   >
     <span
       class="i-lucide:fingerprint shrink-0"
@@ -40,7 +32,7 @@ const title = computed(() =>
   <span
     v-else
     class="inline-flex items-center gap-1 text-xs font-mono text-fg-muted"
-    :title="title"
+    :title="$t('badges.provenance.verified_title')"
   >
     <span
       class="i-lucide:fingerprint shrink-0"
diff --git a/app/components/TrustedPublishingBadge.vue b/app/components/TrustedPublishingBadge.vue
index 3a7e2ef548..de446923c9 100644
--- a/app/components/TrustedPublishingBadge.vue
+++ b/app/components/TrustedPublishingBadge.vue
@@ -13,9 +13,16 @@ const props = withDefaults(
 
 const trustedPublishingDocs = 'https://docs.npmjs.com/trusted-publishers'
 
+const providerLabels: Record<string, string> = {
+  github: 'GitHub Actions',
+  gitlab: 'GitLab CI',
+}
+
 const title = computed(() =>
   props.provider
-    ? $t('badges.trusted_publishing.title_via', { provider: getCiProviderLabel(props.provider) })
+    ? $t('badges.trusted_publishing.title_via', {
+        provider: providerLabels[props.provider] ?? props.provider,
+      })
     : $t('badges.trusted_publishing.title'),
 )
 </script>
diff --git a/app/utils/ci-providers.ts b/app/utils/ci-providers.ts
deleted file mode 100644
index 189e30f29a..0000000000
--- a/app/utils/ci-providers.ts
+++ /dev/null
@@ -1,12 +0,0 @@
-const CI_PROVIDER_LABELS: Record<string, string> = {
-  github: 'GitHub Actions',
-  gitlab: 'GitLab CI',
-}
-
-/**
- * Returns a human-readable label for a CI provider ID (e.g. "github" → "GitHub Actions"),
- * falling back to the ID itself for unknown providers.
- */
-export function getCiProviderLabel(provider: string): string {
-  return CI_PROVIDER_LABELS[provider] ?? provider
-}
diff --git a/i18n/locales/ar.json b/i18n/locales/ar.json
index b6cacb53c1..66b57eef8a 100644
--- a/i18n/locales/ar.json
+++ b/i18n/locales/ar.json
@@ -720,8 +720,7 @@
   "badges": {
     "provenance": {
       "verified": "موثّق",
-      "verified_title": "مصدر موثّق",
-      "verified_via": "موثّق: تم النشر عبر {provider}"
+      "verified_title": "مصدر موثّق"
     },
     "jsr": {
       "title": "متوفر أيضًا على JSR"
diff --git a/i18n/locales/az-AZ.json b/i18n/locales/az-AZ.json
index f7639a466d..052a54389f 100644
--- a/i18n/locales/az-AZ.json
+++ b/i18n/locales/az-AZ.json
@@ -823,8 +823,7 @@
   "badges": {
     "provenance": {
       "verified": "təsdiqlənmiş",
-      "verified_title": "Təsdiqlənmiş mənşə",
-      "verified_via": "Təsdiqlənmiş: {provider} vasitəsilə dərc edilib"
+      "verified_title": "Təsdiqlənmiş mənşə"
     },
     "jsr": {
       "title": "JSR-də də mövcuddur"
diff --git a/i18n/locales/bg-BG.json b/i18n/locales/bg-BG.json
index 780c06058e..6bda9b882f 100644
--- a/i18n/locales/bg-BG.json
+++ b/i18n/locales/bg-BG.json
@@ -784,8 +784,7 @@
   "badges": {
     "provenance": {
       "verified": "потвърден",
-      "verified_title": "Потвърден произход",
-      "verified_via": "Потвърдено: публикувано чрез {provider}"
+      "verified_title": "Потвърден произход"
     },
     "jsr": {
       "title": "налично също в JSR"
diff --git a/i18n/locales/bn-IN.json b/i18n/locales/bn-IN.json
index c66a30e719..aa4171ab4c 100644
--- a/i18n/locales/bn-IN.json
+++ b/i18n/locales/bn-IN.json
@@ -1083,8 +1083,7 @@
   "badges": {
     "provenance": {
       "verified": "যাচাইকৃত",
-      "verified_title": "যাচাইকৃত প্রোভেন্স",
-      "verified_via": "যাচাইকৃত: {provider} এর মাধ্যমে প্রকাশিত"
+      "verified_title": "যাচাইকৃত প্রোভেন্স"
     },
     "jsr": {
       "title": "JSR-এও উপলব্ধ"
diff --git a/i18n/locales/cs-CZ.json b/i18n/locales/cs-CZ.json
index efe1e297ec..4918587422 100644
--- a/i18n/locales/cs-CZ.json
+++ b/i18n/locales/cs-CZ.json
@@ -1073,8 +1073,7 @@
   "badges": {
     "provenance": {
       "verified": "ověřeno",
-      "verified_title": "Ověřený původ",
-      "verified_via": "Ověřeno: publikováno přes {provider}"
+      "verified_title": "Ověřený původ"
     },
     "jsr": {
       "title": "také dostupné na JSR"
diff --git a/i18n/locales/de.json b/i18n/locales/de.json
index d24d774fce..52ac82abb0 100644
--- a/i18n/locales/de.json
+++ b/i18n/locales/de.json
@@ -1030,8 +1030,7 @@
   "badges": {
     "provenance": {
       "verified": "verifiziert",
-      "verified_title": "Verifizierter Herkunftsnachweis",
-      "verified_via": "Verifiziert: veröffentlicht via {provider}"
+      "verified_title": "Verifizierter Herkunftsnachweis"
     },
     "jsr": {
       "title": "auch auf JSR verfügbar"
diff --git a/i18n/locales/en.json b/i18n/locales/en.json
index f19a56f034..bf0f32f9c3 100644
--- a/i18n/locales/en.json
+++ b/i18n/locales/en.json
@@ -1187,8 +1187,7 @@
   "badges": {
     "provenance": {
       "verified": "verified",
-      "verified_title": "Verified provenance",
-      "verified_via": "Verified: published via {provider}"
+      "verified_title": "Verified provenance"
     },
     "staged_publish": {
       "label": "staged publish",
diff --git a/i18n/locales/es.json b/i18n/locales/es.json
index f8c2d05171..56aea728e4 100644
--- a/i18n/locales/es.json
+++ b/i18n/locales/es.json
@@ -1084,8 +1084,7 @@
   "badges": {
     "provenance": {
       "verified": "verificado",
-      "verified_title": "Procedencia verificada",
-      "verified_via": "Verificado: publicado vía {provider}"
+      "verified_title": "Procedencia verificada"
     },
     "jsr": {
       "title": "también disponible en JSR"
diff --git a/i18n/locales/fr-FR.json b/i18n/locales/fr-FR.json
index 07d10ee692..3d9e9ba134 100644
--- a/i18n/locales/fr-FR.json
+++ b/i18n/locales/fr-FR.json
@@ -1077,8 +1077,7 @@
   "badges": {
     "provenance": {
       "verified": "vérifié",
-      "verified_title": "Provenance vérifiée",
-      "verified_via": "Vérifié : publié via {provider}"
+      "verified_title": "Provenance vérifiée"
     },
     "jsr": {
       "title": "aussi disponible sur JSR"
diff --git a/i18n/locales/hi-IN.json b/i18n/locales/hi-IN.json
index 0e3d440933..11a3cabe2d 100644
--- a/i18n/locales/hi-IN.json
+++ b/i18n/locales/hi-IN.json
@@ -854,8 +854,7 @@
   "badges": {
     "provenance": {
       "verified": "सत्यापित",
-      "verified_title": "सत्यापित प्रोवेनेंस",
-      "verified_via": "सत्यापित: {provider} के माध्यम से प्रकाशित"
+      "verified_title": "सत्यापित प्रोवेनेंस"
     },
     "jsr": {
       "title": "JSR पर भी उपलब्ध"
diff --git a/i18n/locales/hu-HU.json b/i18n/locales/hu-HU.json
index d22225945e..6717e177d1 100644
--- a/i18n/locales/hu-HU.json
+++ b/i18n/locales/hu-HU.json
@@ -784,8 +784,7 @@
   "badges": {
     "provenance": {
       "verified": "ellenőrzött",
-      "verified_title": "Ellenőrzött eredet",
-      "verified_via": "Ellenőrizve: {provider} által közzétéve"
+      "verified_title": "Ellenőrzött eredet"
     },
     "jsr": {
       "title": "a JSR-en is elérhető"
diff --git a/i18n/locales/id-ID.json b/i18n/locales/id-ID.json
index 3693349b92..def758b6e8 100644
--- a/i18n/locales/id-ID.json
+++ b/i18n/locales/id-ID.json
@@ -871,8 +871,7 @@
   "badges": {
     "provenance": {
       "verified": "terverifikasi",
-      "verified_title": "Provenans terverifikasi",
-      "verified_via": "Terverifikasi: diterbitkan via {provider}"
+      "verified_title": "Provenans terverifikasi"
     },
     "jsr": {
       "title": "juga tersedia di JSR"
diff --git a/i18n/locales/it-IT.json b/i18n/locales/it-IT.json
index 691db79463..1d2a2c3eba 100644
--- a/i18n/locales/it-IT.json
+++ b/i18n/locales/it-IT.json
@@ -1068,8 +1068,7 @@
   "badges": {
     "provenance": {
       "verified": "verificato",
-      "verified_title": "Provenienza verificata",
-      "verified_via": "Verificato: pubblicato tramite {provider}"
+      "verified_title": "Provenienza verificata"
     },
     "jsr": {
       "title": "disponibile anche su JSR"
diff --git a/i18n/locales/ja-JP.json b/i18n/locales/ja-JP.json
index c1a8fa2765..88dd040884 100644
--- a/i18n/locales/ja-JP.json
+++ b/i18n/locales/ja-JP.json
@@ -1076,8 +1076,7 @@
   "badges": {
     "provenance": {
       "verified": "検証済み",
-      "verified_title": "検証済みprovenance",
-      "verified_via": "検証済み: {provider} 経由で公開"
+      "verified_title": "検証済みprovenance"
     },
     "jsr": {
       "title": "JSRでも利用可能"
diff --git a/i18n/locales/kn-IN.json b/i18n/locales/kn-IN.json
index 45faa2ce19..7a3a8654bc 100644
--- a/i18n/locales/kn-IN.json
+++ b/i18n/locales/kn-IN.json
@@ -615,8 +615,7 @@
   "badges": {
     "provenance": {
       "verified": "ಪರಿಶೀಲಿಸಲಾಗಿದೆ",
-      "verified_title": "ಪರಿಶೀಲಿತ ಮೂಲ",
-      "verified_via": "ಪರಿಶೀಲಿಸಲಾಗಿದೆ: {provider} ಮೂಲಕ ಪ್ರಕಟಿಸಲಾಗಿದೆ"
+      "verified_title": "ಪರಿಶೀಲಿತ ಮೂಲ"
     },
     "jsr": {
       "title": "JSR ನಲ್ಲಿ ಕೂಡ ಲಭ್ಯವಿದೆ"
diff --git a/i18n/locales/ko-KR.json b/i18n/locales/ko-KR.json
index b07f4b7c0f..2cb697b4dd 100644
--- a/i18n/locales/ko-KR.json
+++ b/i18n/locales/ko-KR.json
@@ -1109,8 +1109,7 @@
   "badges": {
     "provenance": {
       "verified": "검증됨",
-      "verified_title": "검증된 출처",
-      "verified_via": "검증됨: {provider}를 통해 게시됨"
+      "verified_title": "검증된 출처"
     },
     "jsr": {
       "title": "JSR에서도 사용 가능"
diff --git a/i18n/locales/mr-IN.json b/i18n/locales/mr-IN.json
index 160a40ec53..e6d40fa481 100644
--- a/i18n/locales/mr-IN.json
+++ b/i18n/locales/mr-IN.json
@@ -831,8 +831,7 @@
   "badges": {
     "provenance": {
       "verified": "सत्यापित",
-      "verified_title": "सत्यापित प्रोव्हनन्स",
-      "verified_via": "सत्यापित: {provider} मार्फत प्रकाशित"
+      "verified_title": "सत्यापित प्रोव्हनन्स"
     },
     "jsr": {
       "title": "JSR वरही उपलब्ध"
diff --git a/i18n/locales/nb-NO.json b/i18n/locales/nb-NO.json
index 1d275f8a62..b321a1c741 100644
--- a/i18n/locales/nb-NO.json
+++ b/i18n/locales/nb-NO.json
@@ -1073,8 +1073,7 @@
   "badges": {
     "provenance": {
       "verified": "verifisert",
-      "verified_title": "Verifisert opprinnelse",
-      "verified_via": "Verifisert: publisert via {provider}"
+      "verified_title": "Verifisert opprinnelse"
     },
     "jsr": {
       "title": "også tilgjengelig på JSR"
diff --git a/i18n/locales/ne-NP.json b/i18n/locales/ne-NP.json
index a5cec7feb7..d998dc0eaa 100644
--- a/i18n/locales/ne-NP.json
+++ b/i18n/locales/ne-NP.json
@@ -1160,8 +1160,7 @@
   "badges": {
     "provenance": {
       "verified": "प्रमाणित",
-      "verified_title": "प्रमाणित प्रोभेनेन्स",
-      "verified_via": "प्रमाणित: {provider} मार्फत प्रकाशित"
+      "verified_title": "प्रमाणित प्रोभेनेन्स"
     },
     "jsr": {
       "title": "JSR मा पनि उपलब्ध"
diff --git a/i18n/locales/nl.json b/i18n/locales/nl.json
index a3ebcc8f4c..3499c95e4d 100644
--- a/i18n/locales/nl.json
+++ b/i18n/locales/nl.json
@@ -1186,8 +1186,7 @@
   "badges": {
     "provenance": {
       "verified": "geverifieerd",
-      "verified_title": "geverifieerde herkomstgegevens",
-      "verified_via": "Geverifieerd: gepubliceerd via {provider}"
+      "verified_title": "geverifieerde herkomstgegevens"
     },
     "staged_publish": {
       "label": "Gefaseerde publicatie",
diff --git a/i18n/locales/pl-PL.json b/i18n/locales/pl-PL.json
index a749ba34b9..cc382d89de 100644
--- a/i18n/locales/pl-PL.json
+++ b/i18n/locales/pl-PL.json
@@ -837,8 +837,7 @@
   "badges": {
     "provenance": {
       "verified": "zweryfikowane",
-      "verified_title": "Zweryfikowane pochodzenie",
-      "verified_via": "Zweryfikowane: opublikowane przez {provider}"
+      "verified_title": "Zweryfikowane pochodzenie"
     },
     "jsr": {
       "title": "dostępne także na JSR"
diff --git a/i18n/locales/pt-BR.json b/i18n/locales/pt-BR.json
index ba01a12857..44af2082dd 100644
--- a/i18n/locales/pt-BR.json
+++ b/i18n/locales/pt-BR.json
@@ -1000,8 +1000,7 @@
   "badges": {
     "provenance": {
       "verified": "verificado",
-      "verified_title": "Proveniência verificada",
-      "verified_via": "Verificado: publicado via {provider}"
+      "verified_title": "Proveniência verificada"
     },
     "jsr": {
       "title": "também disponível no JSR"
diff --git a/i18n/locales/pt-PT.json b/i18n/locales/pt-PT.json
index 812447bea5..a85eea4866 100644
--- a/i18n/locales/pt-PT.json
+++ b/i18n/locales/pt-PT.json
@@ -1011,8 +1011,7 @@
   "badges": {
     "provenance": {
       "verified": "verificado",
-      "verified_title": "Proveniência verificada",
-      "verified_via": "Verificado: publicado via {provider}"
+      "verified_title": "Proveniência verificada"
     },
     "jsr": {
       "title": "também disponível no JSR"
diff --git a/i18n/locales/ro-RO.json b/i18n/locales/ro-RO.json
index 4d8b727368..1babf6b9e8 100644
--- a/i18n/locales/ro-RO.json
+++ b/i18n/locales/ro-RO.json
@@ -1019,8 +1019,7 @@
   "badges": {
     "provenance": {
       "verified": "verificat",
-      "verified_title": "Provenanță verificată",
-      "verified_via": "Verificat: publicat via {provider}"
+      "verified_title": "Provenanță verificată"
     },
     "jsr": {
       "title": "disponibil și pe JSR"
diff --git a/i18n/locales/ru-RU.json b/i18n/locales/ru-RU.json
index 6144c112b8..52a8d8bf8f 100644
--- a/i18n/locales/ru-RU.json
+++ b/i18n/locales/ru-RU.json
@@ -1165,8 +1165,7 @@
   "badges": {
     "provenance": {
       "verified": "подтверждено",
-      "verified_title": "Подтвержденное происхождение",
-      "verified_via": "Подтверждено: опубликовано через {provider}"
+      "verified_title": "Подтвержденное происхождение"
     },
     "jsr": {
       "title": "также доступно на JSR"
diff --git a/i18n/locales/sr-Latn-RS.json b/i18n/locales/sr-Latn-RS.json
index bdfcb74429..f377f7bfd0 100644
--- a/i18n/locales/sr-Latn-RS.json
+++ b/i18n/locales/sr-Latn-RS.json
@@ -868,8 +868,7 @@
   "badges": {
     "provenance": {
       "verified": "verifikovano",
-      "verified_title": "Verifikovano poreklo",
-      "verified_via": "Verifikovano: objavljeno preko {provider}"
+      "verified_title": "Verifikovano poreklo"
     },
     "jsr": {
       "title": "takođe dostupno na JSR-u"
diff --git a/i18n/locales/ta-IN.json b/i18n/locales/ta-IN.json
index c439a464e0..750944d161 100644
--- a/i18n/locales/ta-IN.json
+++ b/i18n/locales/ta-IN.json
@@ -695,8 +695,7 @@
   "badges": {
     "provenance": {
       "verified": "சரிபார்க்கப்பட்டது",
-      "verified_title": "சரிபார்க்கப்பட்ட மூலநிலை",
-      "verified_via": "சரிபார்க்கப்பட்டது: {provider} வழியாக வெளியிடப்பட்டது"
+      "verified_title": "சரிபார்க்கப்பட்ட மூலநிலை"
     },
     "jsr": {
       "title": "JSR-லும் கிடைக்கிறது"
diff --git a/i18n/locales/te-IN.json b/i18n/locales/te-IN.json
index 95e6f2f7f6..1debdb05c8 100644
--- a/i18n/locales/te-IN.json
+++ b/i18n/locales/te-IN.json
@@ -615,8 +615,7 @@
   "badges": {
     "provenance": {
       "verified": "ధృవీకరించబడింది",
-      "verified_title": "ధృవీకరించబడిన ప్రోవెనెన్స్",
-      "verified_via": "ధృవీకరించబడింది: {provider} ద్వారా ప్రచురించబడింది"
+      "verified_title": "ధృవీకరించబడిన ప్రోవెనెన్స్"
     },
     "jsr": {
       "title": "JSR లో కూడా అందుబాటులో ఉంది"
diff --git a/i18n/locales/tr-TR.json b/i18n/locales/tr-TR.json
index 9f5035b735..c1b3ec7787 100644
--- a/i18n/locales/tr-TR.json
+++ b/i18n/locales/tr-TR.json
@@ -1027,8 +1027,7 @@
   "badges": {
     "provenance": {
       "verified": "doğrulanmış",
-      "verified_title": "Doğrulanmış köken",
-      "verified_via": "Doğrulandı: {provider} aracılığıyla yayınlandı"
+      "verified_title": "Doğrulanmış köken"
     },
     "jsr": {
       "title": "JSR'de de mevcut"
diff --git a/i18n/locales/uk-UA.json b/i18n/locales/uk-UA.json
index 3009ba45e1..a44733af27 100644
--- a/i18n/locales/uk-UA.json
+++ b/i18n/locales/uk-UA.json
@@ -1165,8 +1165,7 @@
   "badges": {
     "provenance": {
       "verified": "перевірено",
-      "verified_title": "Перевірене походження",
-      "verified_via": "Перевірено: опубліковано через {provider}"
+      "verified_title": "Перевірене походження"
     },
     "jsr": {
       "title": "також доступно на JSR"
diff --git a/i18n/locales/vi-VN.json b/i18n/locales/vi-VN.json
index 6a69d07785..5cdfabab08 100644
--- a/i18n/locales/vi-VN.json
+++ b/i18n/locales/vi-VN.json
@@ -868,8 +868,7 @@
   "badges": {
     "provenance": {
       "verified": "đã xác minh",
-      "verified_title": "Provenance đã xác minh",
-      "verified_via": "Đã xác minh: xuất bản qua {provider}"
+      "verified_title": "Provenance đã xác minh"
     },
     "jsr": {
       "title": "cũng có trên JSR"
diff --git a/i18n/locales/zh-CN.json b/i18n/locales/zh-CN.json
index 66f0ed67dd..5f979adb3d 100644
--- a/i18n/locales/zh-CN.json
+++ b/i18n/locales/zh-CN.json
@@ -1024,8 +1024,7 @@
   "badges": {
     "provenance": {
       "verified": "已验证",
-      "verified_title": "已验证来源",
-      "verified_via": "已验证：通过 {provider} 发布"
+      "verified_title": "已验证来源"
     },
     "jsr": {
       "title": "也适用于 JSR"
diff --git a/i18n/locales/zh-TW.json b/i18n/locales/zh-TW.json
index 6d6035341e..dc205db53e 100644
--- a/i18n/locales/zh-TW.json
+++ b/i18n/locales/zh-TW.json
@@ -971,8 +971,7 @@
   "badges": {
     "provenance": {
       "verified": "已驗證",
-      "verified_title": "已驗證來源",
-      "verified_via": "已驗證：透過 {provider} 發布"
+      "verified_title": "已驗證來源"
     },
     "jsr": {
       "title": "也適用於 JSR"
diff --git a/i18n/schema.json b/i18n/schema.json
index cb164c0f90..2798225c94 100644
--- a/i18n/schema.json
+++ b/i18n/schema.json
@@ -3567,9 +3567,6 @@
             },
             "verified_title": {
               "type": "string"
-            },
-            "verified_via": {
-              "type": "string"
             }
           },
           "additionalProperties": false
diff --git a/test/nuxt/a11y.spec.ts b/test/nuxt/a11y.spec.ts
index c5b2833bf6..2b59b6e713 100644
--- a/test/nuxt/a11y.spec.ts
+++ b/test/nuxt/a11y.spec.ts
@@ -1067,7 +1067,6 @@ describe('component accessibility audits', () => {
     it('should have no accessibility violations with link', async () => {
       const component = await mountSuspended(ProvenanceBadge, {
         props: {
-          provider: 'github',
           packageName: 'vue',
           version: '3.0.0',
         },
@@ -1079,7 +1078,6 @@ describe('component accessibility audits', () => {
     it('should have no accessibility violations in compact mode', async () => {
       const component = await mountSuspended(ProvenanceBadge, {
         props: {
-          provider: 'github',
           packageName: 'vue',
           version: '3.0.0',
           compact: true,
@@ -5198,7 +5196,7 @@ describe('background theme accessibility', () => {
       name: 'ProvenanceBadge',
       mount: () =>
         mountSuspended(ProvenanceBadge, {
-          props: { provider: 'github', packageName: 'vue', version: '3.0.0' },
+          props: { packageName: 'vue', version: '3.0.0' },
         }),
     },
     {

From 2c04548b7b21331420c7ad5663b845527c8616f1 Mon Sep 17 00:00:00 2001
From: Felix Schneider <99918022+trueberryless@users.noreply.github.com>
Date: Sat, 31 Oct 2026 16:51:34 +0100
Subject: [PATCH 3/3] test: assert trusted publishing badge rendering

---
 test/nuxt/a11y.spec.ts | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/test/nuxt/a11y.spec.ts b/test/nuxt/a11y.spec.ts
index 2b59b6e713..447f56889a 100644
--- a/test/nuxt/a11y.spec.ts
+++ b/test/nuxt/a11y.spec.ts
@@ -1111,6 +1111,9 @@ describe('component accessibility audits', () => {
       })
       const results = await runAxe(component)
       expect(results.violations).toEqual([])
+      expect(component.find('a').attributes('title')).toBe(
+        'Published with trusted publishing via GitHub Actions',
+      )
     })
 
     it('should have no accessibility violations without link', async () => {
@@ -1257,6 +1260,7 @@ describe('component accessibility audits', () => {
       })
       const results = await runAxe(component)
       expect(results.violations).toEqual([])
+      expect(component.findComponent(TrustedPublishingBadge).exists()).toBe(true)
     })
   })