Add permissions configuration to workflows and enable npm provenance

[Copilot]

This PR enhances the security posture of the repository's GitHub Actions workflows by implementing explicit permissions configuration and enabling npm package provenance attestation.

Changes

Security Improvements

All workflows now follow the principle of least privilege by explicitly declaring required permissions:

• nodejs.yml: Added permissions: contents: read for CI builds
• publish.yml: Added permissions: contents: read, id-token: write for automated publishing
• release.yml: Added permissions: contents: write, id-token: write for manual releases

npm Provenance

Both publishing workflows now include the --provenance flag when publishing to npm:

# publish.yml
- run: npm whoami; npm --ignore-scripts publish --provenance

# release.yml  
- run: npm publish --provenance --access public

The id-token: write permission allows GitHub Actions to mint an OIDC token that npm uses to cryptographically sign and attest to the package's build provenance.

Benefits

1. Enhanced Security: Explicit permissions prevent unauthorized actions by limiting workflow capabilities to only what's needed
2. Supply Chain Transparency: Published packages will display "Built and signed on GitHub Actions" badges on npmjs.com
3. Verifiable Builds: Consumers can cryptographically verify that packages were built from this repository using GitHub's infrastructure
4. Best Practices Compliance: Aligns with current GitHub Actions and npm security recommendations

Published packages will now include verifiable attestations showing:

• The source repository and commit SHA
• The GitHub Actions workflow that built the package
• Cryptographic signatures proving authenticity

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• accounts.google.com
  • Triggering command: /opt/google/chrome/chrome --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3623 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-45352262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,4908381743801459248,9728653737246464431,262144 --disable-features=PaintHolding --variations-seed-version (dns block)
  • Triggering command: /opt/google/chrome/chrome --user-data-dir=/tmp/karma-45352262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl http://localhost:9876/?id=45352262 (dns block)
• clients2.google.com
  • Triggering command: /opt/google/chrome/chrome --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3623 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-45352262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,4908381743801459248,9728653737246464431,262144 --disable-features=PaintHolding --variations-seed-version (dns block)
  • Triggering command: /opt/google/chrome/chrome --user-data-dir=/tmp/karma-45352262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl http://localhost:9876/?id=45352262 (dns block)
• clientservices.googleapis.com
  • Triggering command: /opt/google/chrome/chrome --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3623 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-45352262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,4908381743801459248,9728653737246464431,262144 --disable-features=PaintHolding --variations-seed-version (dns block)
  • Triggering command: /opt/google/chrome/chrome --user-data-dir=/tmp/karma-45352262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl http://localhost:9876/?id=45352262 (dns block)
• redirector.gvt1.com
  • Triggering command: /opt/google/chrome/chrome --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3623 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-45352262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,4908381743801459248,9728653737246464431,262144 --disable-features=PaintHolding --variations-seed-version (dns block)
  • Triggering command: /opt/google/chrome/chrome --user-data-dir=/tmp/karma-45352262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl http://localhost:9876/?id=45352262 (dns block)
• safebrowsingohttpgateway.googleapis.com
  • Triggering command: /opt/google/chrome/chrome --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3623 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-45352262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,4908381743801459248,9728653737246464431,262144 --disable-features=PaintHolding --variations-seed-version (dns block)
  • Triggering command: /opt/google/chrome/chrome --user-data-dir=/tmp/karma-45352262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl http://localhost:9876/?id=45352262 (dns block)
• www.google.com
  • Triggering command: /opt/google/chrome/chrome --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --disable-dev-shm-usage --use-angle=swiftshader-webgl --crashpad-handler-pid=3623 --enable-crash-reporter=, --noerrdialogs --user-data-dir=/tmp/karma-45352262 --change-stack-guard-on-fork=enable --shared-files=v8_context_snapshot_data:100 --field-trial-handle=3,i,4908381743801459248,9728653737246464431,262144 --disable-features=PaintHolding --variations-seed-version (dns block)
  • Triggering command: /opt/google/chrome/chrome --user-data-dir=/tmp/karma-45352262 --enable-automation --no-default-browser-check --no-first-run --disable-default-apps --disable-popup-blocking --disable-translate --disable-REDACTED-timer-throttling --disable-renderer-REDACTEDing --disable-device-discovery-notifications --headless --disable-gpu --disable-dev-shm-usage --remote-debugging-port=9222 --noerrdialogs --ozone-platform=headless --ozone-override-screen-size=800,600 --use-angle=swiftshader-webgl http://localhost:9876/?id=45352262 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Add basic permissions configuration for all actions workflows. For the release action, add id-token and update the npm publish command to use provenance

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[Copilot]

Pull Request Overview

This PR enhances the security posture of GitHub Actions workflows by implementing explicit permissions configuration following the principle of least privilege and enabling npm package provenance attestation for supply chain transparency.

• Added explicit permission declarations to all three workflow files to limit access rights
• Enabled npm provenance attestation with --provenance flag for published packages
• Configured id-token: write permissions to support OIDC token generation for cryptographic signing

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/nodejs.yml	Added read-only contents permission for CI builds
.github/workflows/publish.yml	Added contents read and id-token write permissions, enabled npm provenance
.github/workflows/release.yml	Added contents write and id-token write permissions, enabled npm provenance

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[jibrang]

Why do we need to use --provenance here?

[dgreif]

This is a newer feature with npm which we've turned on in most of our OSS packages. It provides hard links back to the action which built the published version, improving trust and integrity of npm packages.

[jibrang]

Cool! Thanks for the context!