search

octokit / core.js

Extendable client for GitHub's REST & GraphQL APIs
MIT License
1.19k stars 310 forks source link

feat(security): Add provenance #671

Closed AaronDewes closed 7 months ago

AaronDewes commented 7 months ago

This help increase trust in the builds on NPM by showing they were indeed generated from the same source code as this repository contains.

github-actions[bot] commented 7 months ago

👋 Hi! Thank you for this contribution! Just to let you know, our GitHub SDK team does a round of issue and PR reviews twice a week, every Monday and Friday! We have a process in place for prioritizing and responding to your input. Because you are a part of this community please feel free to comment, add to, or pick up any issues/PRs that are labled with Status: Up for grabs. You & others like you are the reason all of this works! So thank you & happy coding! 🚀

wolfy1339 commented 7 months ago

I think it would be wise to backport this for 5.x releases as well, as that is what is used be Probot

github-actions[bot] commented 7 months ago

:tada: This PR is included in version 6.1.0 :tada:

The release is available on:

Your semantic-release bot :package::rocket:

AaronDewes commented 7 months ago

I think it would be wise to backport this for 5.x releases as well, as that is what is used be Probot

I don't think that's necessary, provenance is not that important, and hopefully, we'll be able to update Probot soon.