feat(publish): provenance attestation

cli/Cargo.toml

@@ -120,19 +120,22 @@ notify.workspace = true
 once_cell.workspace = true
 open = "5.0.1"
 os_pipe.workspace = true
+p256.workspace = true
 percent-encoding.workspace = true
 phf.workspace = true
 pin-project.workspace = true
 quick-junit = "^0.3.5"
 rand = { workspace = true, features = ["small_rng"] }
 regex.workspace = true
+reqwest.workspace = true
 ring.workspace = true
 rustyline.workspace = true
 rustyline-derive = "=0.7.0"
 serde.workspace = true
 serde_repr.workspace = true
 sha2.workspace = true
 shell-escape = "=0.1.5"
+spki = { version = "0.7", features = ["pem"] }
 tar.workspace = true
 tempfile.workspace = true
 text-size = "=1.1.0"

cli/args/flags.rs

@@ -302,6 +302,7 @@ pub struct PublishFlags {
   pub token: Option<String>,
   pub dry_run: bool,
   pub allow_slow_types: bool,
+  pub provenance: bool,
 }
 
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -2395,6 +2396,12 @@ fn publish_subcommand() -> Command {
           .help("Allow publishing with slow types")
           .action(ArgAction::SetTrue),
       )
+      .arg(
+        Arg::new("provenance")
+          .long("provenance")
+          .help("From CI/CD system, publicly links the package to where it was built and published from.")
+          .action(ArgAction::SetTrue)
+      )
       .arg(check_arg(/* type checks by default */ true))
       .arg(no_check_arg())
     })
@@ -3835,6 +3842,7 @@ fn publish_parse(flags: &mut Flags, matches: &mut ArgMatches) {
     token: matches.remove_one("token"),
     dry_run: matches.get_flag("dry-run"),
     allow_slow_types: matches.get_flag("allow-slow-types"),
+    provenance: matches.get_flag("provenance"),
   });
 }
 
@@ -8565,6 +8573,26 @@ mod tests {
           token: Some("asdf".to_string()),
           dry_run: true,
           allow_slow_types: true,
+          provenance: false,
+        }),
+        type_check_mode: TypeCheckMode::Local,
+        ..Flags::default()
+      }
+    );
+  }
+
+  #[test]
+  fn publish_provenance_args() {
+    let r =
+      flags_from_vec(svec!["deno", "publish", "--provenance", "--token=asdf",]);
+    assert_eq!(
+      r.unwrap(),
+      Flags {
+        subcommand: DenoSubcommand::Publish(PublishFlags {
+          token: Some("asdf".to_string()),
+          dry_run: false,
+          allow_slow_types: false,
+          provenance: true,
         }),
         type_check_mode: TypeCheckMode::Local,
         ..Flags::default()

cli/tools/registry/auth.rs

@@ -17,6 +17,14 @@ pub struct OidcConfig {
   pub token: String,
 }
 
+pub(crate) fn is_gha() -> bool {
+  std::env::var("GITHUB_ACTIONS").unwrap_or_default() == "true"
+}
+
+pub(crate) fn gha_oidc_token() -> Option<String> {
+  std::env::var("ACTIONS_ID_TOKEN_REQUEST_TOKEN").ok()
+}
+
 fn get_gh_oidc_env_vars() -> Option<Result<(String, String), AnyError>> {
   if std::env::var("GITHUB_ACTIONS").unwrap_or_default() == "true" {
     let url = std::env::var("ACTIONS_ID_TOKEN_REQUEST_URL");