fix: add provenance, publish as latest?

.github/workflows/build.yml

@@ -47,6 +47,12 @@ jobs:
 
     runs-on: ubuntu-latest
 
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
+
     steps:
       # sadly, we have to re-do the build... but we can skip lint/test
       - uses: actions/checkout@v3
@@ -63,6 +69,7 @@ jobs:
             ${{ runner.os }}-node-
 
       - run: npm ci
+      - run: npm audit signatures
       - run: npm run build
       - run: npm run release
         env:

.releaserc.yaml

@@ -2,10 +2,12 @@ branches:
   - name: main
   - name: alpha
     prerelease: true
-    channel: latest
   # - name: beta
   #   prerelease: true
 
+# also run `npm dist-tag add wordpressed@0.1.0-alpha.XXX latest` to update latest.
+# (could be an exec step!)
+
 plugins:
   - '@semantic-release/commit-analyzer'
   - '@semantic-release/release-notes-generator'

package.json

@@ -10,7 +10,7 @@
     "client"
   ],
   "publishConfig": {
-    "tag": "alpha"
+    "tag": "latest"
   },
   "type": "module",
   "main": "index.js",