I'll look into adding official support via an option, but in the mean time, provenance should already work! As noted in the npm documentation, since this action calls npm publish directly, you can configure the provenance option a few different ways:

An environment variable
the publishConfig option of package.json
a project-local .npmrc file for the project.

All three should be compatible with this action, and I recommend option 2 - the package.json field - for portability.

Manifest:

{
  "name": "my-cool-package",
  "version": "1.2.3",
  "publishConfig": {
    "provenance": true
  }
}

Workflow:

name: Publish package to npm with provenance
on:
 push:
   branches: [main]
jobs:
 build:
   runs-on: ubuntu-latest
   permissions:
     contents: read
     id-token: write
   steps:
     - uses: actions/checkout@v3
     - uses: actions/setup-node@v3
       with:
         node-version: '18'
     - run: npm install -g npm@latest
     - run: npm ci
     - uses: JS-DevTools/npm-publish@v2
       with:
         token: ${{ secrets.NPM_TOKEN }}

Support NPM Package Provenance #88

Description

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions