feat: add npm package provenance

Ref: https://github.blog/2023-04-19-introducing-npm-package-provenance/
Thream · May 13, 2023 · 4dba3ad · 4dba3ad
1 parent 41d9424
commit 4dba3ad
Show file tree

Hide file tree

Showing 4 changed files with 15 additions and 3 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -7,6 +7,11 @@ on:
 jobs:
   release:
     runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      issues: 'write'
+      pull-requests: 'write'
+      id-token: 'write'
     steps:
       - uses: 'actions/checkout@v3.5.2'
 
@@ -24,6 +29,9 @@ jobs:
 
       - run: 'npm run build:typescript'
 
+      - name: 'Verify the integrity of provenance attestations and registry signatures for installed dependencies'
+        run: 'npm audit signatures'
+
       - name: 'Release'
         run: 'npm run release'
         env:

diff --git a/.npmrc b/.npmrc
@@ -1 +1,2 @@
 save-exact=true
+provenance=true
diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -11,10 +11,12 @@
     "build"
   ],
   "engines": {
-    "node": ">=16.0.0"
+    "node": ">=16.0.0",
+    "npm": ">=9.0.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "keywords": [
     "socket",