From df16d505b76327e74c7f69ad50bd5e1149e7a488 Mon Sep 17 00:00:00 2001 From: saibotk Date: Fri, 22 Mar 2024 18:16:16 +0100 Subject: [PATCH] ci: add provenance to insider packages (#29) This commit adds provenance for insider packages. See the NPM documentation [0]. Provenance will allow people to verify that the packages were actually built on GH Actions and with the content of the corresponding commit. This will help with supply chain security. For this to work, the `id-token` permission was added only where necessary. [0]: https://docs.npmjs.com/generating-provenance-statements --- .github/workflows/release-insiders.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-insiders.yml b/.github/workflows/release-insiders.yml index 5255dc5..138d078 100644 --- a/.github/workflows/release-insiders.yml +++ b/.github/workflows/release-insiders.yml @@ -4,6 +4,10 @@ on: push: branches: [master] +permissions: + contents: read + id-token: write + jobs: build: runs-on: ubuntu-latest @@ -44,7 +48,7 @@ jobs: run: npm version 0.0.0-insiders.${{ steps.vars.outputs.sha_short }} --force --no-git-tag-version - name: Publish - run: npm publish --tag insiders + run: npm publish --provenance --tag insiders env: CI: true NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}