From e1d4dc7fad73bec8b6fa4cbc25e50f423e3cee07 Mon Sep 17 00:00:00 2001 From: saibotk Date: Fri, 22 Mar 2024 18:24:02 +0100 Subject: [PATCH] ci: add provenance to insider packages (#336) This commit adds provenance for insider packages. See the NPM documentation [0]. Provenance will allow people to verify that the packages were actually built on GH Actions and with the content of the corresponding commit. This will help with supply chain security. For this to work, the `id-token` permission was added only where necessary. [0]: https://docs.npmjs.com/generating-provenance-statements --- .github/workflows/release-insiders.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-insiders.yml b/.github/workflows/release-insiders.yml index bc7b345..8ec2def 100644 --- a/.github/workflows/release-insiders.yml +++ b/.github/workflows/release-insiders.yml @@ -4,6 +4,10 @@ on: push: branches: [master] +permissions: + contents: read + id-token: write + jobs: build: runs-on: ubuntu-latest @@ -49,7 +53,7 @@ jobs: run: npm version 0.0.0-insiders.${{ steps.vars.outputs.sha_short }} --force --no-git-tag-version - name: Publish - run: npm publish --tag insiders + run: npm publish --provenance --tag insiders env: CI: true NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}