From 5ec4852638dc29bf0efebc35131e9250209443e8 Mon Sep 17 00:00:00 2001 From: saibotk Date: Wed, 6 Mar 2024 02:18:41 +0100 Subject: [PATCH] ci: add provenance to insider packages This commit adds provenance for insider packages. See the NPM documentation [0]. Provenance will allow people to verify that the packages were actually built on GH Actions and with the content of the corresponding commit. This will help with supply chain security. For this to work, the `id-token` permission was added only where necessary. [0]: https://docs.npmjs.com/generating-provenance-statements --- .github/workflows/release-insiders.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release-insiders.yml b/.github/workflows/release-insiders.yml index bc7b345..8ec2def 100644 --- a/.github/workflows/release-insiders.yml +++ b/.github/workflows/release-insiders.yml @@ -4,6 +4,10 @@ on: push: branches: [master] +permissions: + contents: read + id-token: write + jobs: build: runs-on: ubuntu-latest @@ -49,7 +53,7 @@ jobs: run: npm version 0.0.0-insiders.${{ steps.vars.outputs.sha_short }} --force --no-git-tag-version - name: Publish - run: npm publish --tag insiders + run: npm publish --provenance --tag insiders env: CI: true NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}