[Feature Request] NPM provenance

[jonluca]

New feature motivation

You can generate provenance statements for the packages you publish. This allows you to publicly establish where a package was built and who published a package, which can increase supply-chain security for your packages.

New feature description

https://docs.npmjs.com/generating-provenance-statements

NPM has provenance statements in Github Actions - it would be great if we could add a flag that adds it in semantic-release

New feature implementation

No response

[travi]

This is already supported. Please see https://github.com/semantic-release/npm#npm-provenance

Would additional details or highlighting this in another part of our docs make this more clear?

[travi]

i've added another mention of using provenance to our docs here, so i'm going to close this for now. feel free to still respond if you think that other mentions elsewhere would have been helpful when you were looking for this information.

[jonluca]

Awesome, nope I should've RTFM. Thanks!

[travi]

No worries. Since its new, still trying to figure out the best way to make it clear that we're good to go. Excited to see that you're already opting in to using provenance 🎉

[jonluca]

One more minor thing that is definitely due to me blindly copy + pasting, but if you copy + paste the default ci from the npm docs you link to, it causes semantic release to fail with EGITNOPERMISSION.

The docs have

name: Publish Package to npmjs
on:
 release:
   types: [created]
jobs:
 build:
   runs-on: ubuntu-latest
   permissions:
     contents: read
     id-token: write
   steps:
     - uses: actions/checkout@v3
     - uses: actions/setup-node@v3
       with:
         node-version: '18.x'
         registry-url: 'https://registry.npmjs.org'
     - run: npm install -g npm
     - run: npm ci
     - run: npm publish --provenance --access public
       env:
         NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

as the default, but it needs to be:

    permissions:
      contents: write
      id-token: write

for it to work (due to pushing to the master branch)

[travi]

do you have a suggestion to improve our reference? we don't have direct influence over the npm docs, but there is a link at the bottom of their docs to contribute to them. have you suggested a change there?

since npm provenance requires a project be an npm package and published from github actions, the details do end up being split between the documentation for each of the plugins at bit. the github actions recipe has the consolidated permissions defined within it. interested if there are suggestions to improve to make the details easier to find.