From b2a9d02229946f3430c0013198be2affa7a175da Mon Sep 17 00:00:00 2001 From: saibotk Date: Fri, 22 Mar 2024 18:16:26 +0100 Subject: [PATCH] ci: add provenance to insider packages (#38) This commit adds provenance for insider packages. See the NPM documentation [0]. Provenance will allow people to verify that the packages were actually built on GH Actions and with the content of the corresponding commit. This will help with supply chain security. For this to work, the `id-token` permission was added only where necessary. [0]: https://docs.npmjs.com/generating-provenance-statements --- .github/workflows/release-insiders.yml | 8 ++++++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a/.github/workflows/release-insiders.yml b/.github/workflows/release-insiders.yml index 5255dc5..2d77e8e 100644 --- a/.github/workflows/release-insiders.yml +++ b/.github/workflows/release-insiders.yml @@ -4,6 +4,10 @@ on: push: branches: [master] +permissions: + contents: read + id-token: write + jobs: build: runs-on: ubuntu-latest @@ -40,11 +44,11 @@ jobs: id: vars run: echo "::set-output name=sha_short::$(git rev-parse --short HEAD)" - - name: "Version based on commit: 0.0.0-insiders.${{ steps.vars.outputs.sha_short }}" + - name: 'Version based on commit: 0.0.0-insiders.${{ steps.vars.outputs.sha_short }}' run: npm version 0.0.0-insiders.${{ steps.vars.outputs.sha_short }} --force --no-git-tag-version - name: Publish - run: npm publish --tag insiders + run: npm publish --provenance --tag insiders env: CI: true NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}