From 25d4f1152ac0565429ac8ce351f8b21f79d69401 Mon Sep 17 00:00:00 2001 From: Nicolas Fry Date: Sun, 9 Aug 2026 21:04:02 -0400 Subject: [PATCH] ci: publish to npm with provenance attestation Add id-token: write (plus explicit contents: read for actions/checkout) to the publish-npm job and pass --provenance to npm publish, so releases carry a signed SLSA build attestation linking the tarball to this workflow run. --- .github/workflows/npm-publish.yml | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/.github/workflows/npm-publish.yml b/.github/workflows/npm-publish.yml index 2518c32..39a4ace 100644 --- a/.github/workflows/npm-publish.yml +++ b/.github/workflows/npm-publish.yml @@ -28,6 +28,9 @@ jobs: publish-npm: needs: build # Wait for tests to pass before publishing runs-on: ubuntu-latest + permissions: + contents: read # Needed by actions/checkout + id-token: write # Needed to mint the OIDC token npm uses to sign the provenance attestation steps: - uses: actions/checkout@v5 @@ -43,6 +46,7 @@ jobs: - run: npm run build:prod # Publish to npm with public access (scoped packages are private by default) - - run: npm publish --access public + # --provenance attaches a signed SLSA build attestation linking the tarball to this workflow run + - run: npm publish --access public --provenance env: NODE_AUTH_TOKEN: ${{secrets.npm_token}} # Use npm token from GitHub secrets