chore: add --provenance flag to the npm publish command (#60)

biomejs · Aug 24, 2023 · 814d039 · 814d039
1 parent c737d4e
commit 814d039
Show file tree

Hide file tree

Showing 2 changed files with 8 additions and 4 deletions.
diff --git a/.github/workflows/release_cli.yml b/.github/workflows/release_cli.yml
@@ -173,6 +173,7 @@ jobs:
  environment: npm-publish
  permissions:
  contents: write
+ id-token: write
  steps:
  - uses: actions/checkout@v3
 
@@ -199,12 +200,12 @@ jobs:
  run: node packages/@biomejs/biome/scripts/generate-packages.mjs
 
  - name: Publish npm packages as latest
- run: for package in packages/@biomejs/*; do if [ $package != "packages/@biomejs/js-api" ]; then npm publish $package --tag latest --access public; fi; done
+ run: for package in packages/@biomejs/*; do if [ $package != "packages/@biomejs/js-api" ]; then npm publish $package --tag latest --access public --provenance; fi; done
  if: needs.build.outputs.prerelease != 'true'
  env:
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
  - name: Publish npm packages as nightly
- run: for package in packages/@biomejs/*; do if [ $package != "packages/@biomejs/js-api" ]; then npm publish $package --tag nightly --access public; fi; done
+ run: for package in packages/@biomejs/*; do if [ $package != "packages/@biomejs/js-api" ]; then npm publish $package --tag nightly --access public --provenance; fi; done
  if: needs.build.outputs.prerelease == 'true'
  env:
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

diff --git a/.github/workflows/release_js_api.yml b/.github/workflows/release_js_api.yml
@@ -121,6 +121,9 @@ jobs:
  runs-on: ubuntu-latest
  needs: build
  environment: npm-publish
+ permissions:
+ contents: read
+ id-token: write
  steps:
  - uses: actions/checkout@v3
 
@@ -141,12 +144,12 @@ jobs:
  run: node packages/@biomejs/js-api/scripts/update-nightly-version.mjs
 
  - name: Publish npm package as latest
- run: npm publish packages/@biomejs/js-api --tag latest --access public
+ run: npm publish packages/@biomejs/js-api --tag latest --access public --provenance
  if: needs.build.outputs.prerelease != 'true'
  env:
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
  - name: Publish npm package as nightly
- run: npm publish packages/@biomejs/js-api --tag nightly --access public
+ run: npm publish packages/@biomejs/js-api --tag nightly --access public --provenance
  if: needs.build.outputs.prerelease == 'true'
  env:
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}