Skip to content

Commit

Permalink
feat(security): Add provenance (#535)
Browse files Browse the repository at this point in the history
* Enable provenance in package.json

* Add necessary permissions to the release workflow
  • Loading branch information
AaronDewes authored Apr 3, 2024
1 parent 7d5ecaf commit dcf1fa3
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 1 deletion.
7 changes: 7 additions & 0 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -3,6 +3,13 @@ name: Release
push:
branches:
- main
# These are recommended by the semantic-release docs: https://github.com/semantic-release/npm#npm-provenance
permissions:
contents: write # to be able to publish a GitHub release
issues: write # to be able to comment on released issues
pull-requests: write # to be able to comment on released pull requests
id-token: write # to enable use of OIDC for npm provenance

jobs:
release:
name: release
Expand Down
3 changes: 2 additions & 1 deletion package.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,8 @@
"name": "@octokit/plugin-retry",
"version": "0.0.0-development",
"publishConfig": {
"access": "public"
"access": "public",
"provenance": true
},
"type": "module",
"description": "Automatic retry plugin for octokit",
Expand Down

0 comments on commit dcf1fa3

Please sign in to comment.