From 98a600ce519f099d8f7fec12e01e48e033ea02d0 Mon Sep 17 00:00:00 2001 From: Aaron Dewes Date: Wed, 3 Apr 2024 21:08:54 +0200 Subject: [PATCH] feat(security): Add provenance (#228) * Enable provenance in package.json * Add necessary permissions to the release workflow --- .github/workflows/release.yml | 7 +++++++ package.json | 3 ++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index e034cc4b..1c9431c0 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -3,6 +3,13 @@ name: Release push: branches: - main +# These are recommended by the semantic-release docs: https://github.com/semantic-release/npm#npm-provenance +permissions: + contents: write # to be able to publish a GitHub release + issues: write # to be able to comment on released issues + pull-requests: write # to be able to comment on released pull requests + id-token: write # to enable use of OIDC for npm provenance + jobs: release: name: release diff --git a/package.json b/package.json index 7944a51c..50ecd69a 100644 --- a/package.json +++ b/package.json @@ -2,7 +2,8 @@ "name": "@octokit/app-permissions", "version": "0.0.0-development", "publishConfig": { - "access": "public" + "access": "public", + "provenance": true }, "description": "machine-readable, always up-to-date GitHub App permissions", "main": "index.js",