Skip to content

v2.0.4 — npm provenance via CI trusted publishing

Choose a tag to compare

View all tags
@shayaShav shayaShav released this 02 Jul 18:32
v2.0.4
This tag was signed with the committer’s verified signature.
shayaShav Shaya Shaviv
SSH Key Fingerprint: ZySyE5R3hRlMGuiWG6kRnNtFHPEsRn8initzdUcI2DA
Verified
Learn about vigilant mode.
eb09dbf

Starting with this release, npm packages are published by GitHub Actions via OIDC trusted publishing: no npm tokens exist anywhere, every release carries SLSA provenance attestations (verify with npm audit signatures or on the npm package page), and release tags are SSH-signed. No engine changes.

What's Changed

  • ci: npm OIDC trusted publishing with provenance and signed release tags by @shayaShav in #5

Full Changelog: v2.0.3...v2.0.4

Contributors

shayaShav
Assets 2
Loading