search

actions / toolkit

The GitHub ToolKit for developing GitHub Actions.
https://github.com/features/actions
MIT License
5.02k stars 1.45k forks source link

publish npm packages with build provenance #1674

Closed bdehamer closed 8 months ago

bdehamer commented 8 months ago

Updates the releases workflow to publish npm packages with build provenance information.

The build provenance attestation will be attached the package and can be verified with the npm audit signatures command.

Packages published with provenance also get a badge like this when viewed on the npmjs registry.

image

See https://docs.npmjs.com/generating-provenance-statements