ci: add npm provenance

.github/workflows/publish.yml

@@ -0,0 +1,28 @@
+name: Publish Package to npmjs
+on:
+  release:
+    types: [published]
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v3
+      - uses: actions/setup-node@v3
+        with:
+          node-version: '20.x'
+          registry-url: 'https://registry.npmjs.org'
+      - name: Install Dependencies
+        run: yarn install
+      - name: Publish to NPM (beta)
+        if: "github.event.release.prerelease"
+        run: npm publish --provenance --access public --tag beta --dry
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+      - name: Publish to NPM (release)
+        if: "!github.event.release.prerelease"
+        run: npm publish --provenance --access public --dry
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.npmrc

@@ -1 +1,2 @@
+provenance=true
 save-exact=false

package.json

@@ -1,12 +1,15 @@
 {
   "name": "requirements",
-  "version": "1.4.1",
+  "version": "2.0.0-beta.0",
   "license": "MIT",
   "author": "chimurai",
   "homepage": "https://github.com/chimurai/requirements",
   "bugs": {
     "url": "https://github.com/chimurai/requirements/issues"
   },
+  "publishConfig": {
+    "provenance": true
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/chimurai/requirements.git"