From 08c15f08a46f9f59abc1c702a167136665e53f29 Mon Sep 17 00:00:00 2001 From: Aaron Dewes Date: Wed, 3 Apr 2024 20:02:34 +0200 Subject: [PATCH 1/2] Enable provenance in package.json --- package.json | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/package.json b/package.json index efbe66c28..94055f540 100644 --- a/package.json +++ b/package.json @@ -3,7 +3,8 @@ "version": "0.0.0-development", "type": "module", "publishConfig": { - "access": "public" + "access": "public", + "provenance": true }, "description": "Send parameterized requests to GitHub's APIs with sensible defaults in browsers and Node", "scripts": { From 4f65f084f1db98fce5161f0b59f9d646ca96e1d2 Mon Sep 17 00:00:00 2001 From: Aaron Dewes Date: Wed, 3 Apr 2024 20:02:34 +0200 Subject: [PATCH 2/2] Add necessary permissions to the release workflow --- .github/workflows/release.yml | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e2f2be4bf..a71300641 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -11,6 +11,13 @@ permissions: contents: write issues: write +# These are recommended by the semantic-release docs: https://github.com/semantic-release/npm#npm-provenance +permissions: + contents: write # to be able to publish a GitHub release + issues: write # to be able to comment on released issues + pull-requests: write # to be able to comment on released pull requests + id-token: write # to enable use of OIDC for npm provenance + jobs: release: name: release