Generate npm package provenance

Following https://docs.npmjs.com/generating-provenance-statements
Ecodev · Mar 8, 2024 · c9e8da7 · c9e8da7
1 parent 6afae92
commit c9e8da7
Showing 1 changed file with 5 additions and 2 deletions.
diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml
@@ -54,6 +54,9 @@ jobs:
 
     release:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write
         if: github.event_name == 'push' && contains(github.ref, 'refs/tags/')
         needs:
             - build
@@ -73,7 +76,7 @@ jobs:
               with:
                   node-version: '18'
                   registry-url: 'https://registry.npmjs.org'
-            - run: npm publish --access public dist/angular-natural-gallery/
+            - run: npm publish --provenance --access public dist/angular-natural-gallery/
               env:
                   NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
@@ -82,7 +85,7 @@ jobs:
               with:
                   node-version: '18'
                   registry-url: 'https://npm.pkg.github.com'
-            - run: npm publish --access public dist/angular-natural-gallery/
+            - run: npm publish --provenance --access public dist/angular-natural-gallery/
               env:
                   NODE_AUTH_TOKEN: ${{ secrets.GITHUB_TOKEN }}