chore: publish package provenance info (#2469)

According to https://docs.npmjs.com/generating-provenance-statements#example-github-actions-workflow closes #2461
sveltejs · Aug 20, 2024 · 815a1ff · 815a1ff
1 parent ef5ae2c
commit 815a1ff
Show file tree

Hide file tree

Showing 4 changed files with 16 additions and 4 deletions.
diff --git a/.github/workflows/DeploySvelte2tsxProd.yml b/.github/workflows/DeploySvelte2tsxProd.yml
@@ -7,6 +7,9 @@ on:
 
 jobs:
  deploy:
+ permissions:
+ id-token: write # OpenID Connect token needed for provenance
+
  runs-on: ubuntu-latest
 
  steps:
@@ -32,7 +35,7 @@ jobs:
  - run: |
  cd packages/svelte2tsx
  pnpm install
- pnpm publish --no-git-checks
+ pnpm publish --provenance --no-git-checks
 
  env:
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/DeploySvelteCheckProd.yml b/.github/workflows/DeploySvelteCheckProd.yml
@@ -7,6 +7,9 @@ on:
 
 jobs:
  deploy:
+ permissions:
+ id-token: write # OpenID Connect token needed for provenance
+
  runs-on: ubuntu-latest
 
  steps:
@@ -33,7 +36,7 @@ jobs:
  - run: |
  cd packages/svelte-check
  pnpm install
- pnpm publish --no-git-checks
+ pnpm publish --provenance --no-git-checks
 
  env:
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/DeploySvelteLanguageServerProd.yml b/.github/workflows/DeploySvelteLanguageServerProd.yml
@@ -7,6 +7,9 @@ on:
 
 jobs:
  deploy:
+ permissions:
+ id-token: write # OpenID Connect token needed for provenance
+
  runs-on: ubuntu-latest
 
  steps:
@@ -32,7 +35,7 @@ jobs:
  - run: |
  cd packages/language-server
  pnpm install
- pnpm publish --no-git-checks
+ pnpm publish --provenance --no-git-checks
 
  env:
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
diff --git a/.github/workflows/DeployTypescriptPluginProd.yaml b/.github/workflows/DeployTypescriptPluginProd.yaml
@@ -7,6 +7,9 @@ on:
 
 jobs:
  deploy:
+ permissions:
+ id-token: write # OpenID Connect token needed for provenance
+
  runs-on: ubuntu-latest
 
  steps:
@@ -32,7 +35,7 @@ jobs:
  - run: |
  cd packages/typescript-plugin
  pnpm install
- pnpm publish --no-git-checks
+ pnpm publish --provenance --no-git-checks
 
  env:
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}