chore: Publish to NPM with provenance - #2276
Conversation
Sorry, something went wrong.
The release process in this repository is already automated via GitHub Actions, which is a great first step toward creating trust in the supply chain. Recently, NPM has started to support publishing with the `--provenance` flag. This flag creates a link between the GitHub Actions run that created the release and the final artifact on NPM. This linkage further ensures that package installs can be traced back to a specific code revision. For more information on publishing with provenance, please refer to: https://github.blog/2023-04-19-introducing-npm-package-provenance/
Codecov ReportPatch and project coverage have no change. Additional details and impacted files @@ Coverage Diff @@
## master #2276 +/- ##
=======================================
Coverage 99.95% 99.95%
=======================================
Files 107 107
Lines 2454 2454
Branches 619 619
=======================================
Hits 2453 2453
Partials 1 1 ☔ View full report in Codecov by Sentry. |
Sorry, something went wrong.
WikiRik
left a comment
There was a problem hiding this comment.
Do we need to set up anything different than now? Like refreshing the NPM token with different permissions. Or is it all set up, ready to go already since we publish to NPM?
Sorry, something went wrong.
|
@WikiRik This is all that's needed. NPM and GitHub Actions handles the rest automatically. |
Sorry, something went wrong.
|
Please also refer to the following page if in doubt: https://docs.npmjs.com/generating-provenance-statements#publishing-packages-with-provenance-via-github-actions |
Sorry, something went wrong.
chore: Publish to NPM with provenance
The release process in this repository is already automated via GitHub Actions, which is a great first step toward creating trust in the supply chain. Recently, NPM has started to support publishing with the --provenance flag. This flag creates a link between the GitHub Actions run that created the release and the final artifact on NPM. This linkage further ensures that package installs can be traced back to a specific code revision.
For more information on publishing with provenance, please refer to: https://github.blog/2023-04-19-introducing-npm-package-provenance/
Note that the update of Node.js to v18 is required for NPM v9.5+ to be installed, which is needed for provenance.
Checklist