Add npm provenance to npm package #2205
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Merged
Desplandis
approved these changes
Oct 11, 2023
Comment on lines
+144
to
+145
| permissions: | ||
| id-token: write |
There was a problem hiding this comment.
Is there any reason we need to elevate permission on id-token? According to npm provenance documentation, this seems mandatory to authenticate the action with its GITHUB_TOKEN. But can't find a documentation of the behavior of id_token.
There was a problem hiding this comment.
I didn't get into the details of the id-token permission, I followed the npm provenance doc that said to add it. You can find the documentation about id-token here
There was a problem hiding this comment.
Thanks! I understand the rationale now!
Ready To Merge then!
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Description
Add npm provenance to npm published packages. npm provenance is only available as of npm cli 9.5.0+ so I also updated the deployment workflow node version from 16 to 18.
Tested on my fork (with publication on my npm account).
Motivation and Context
Use a newly introduced npm feature and explicitely link our npm releases to this repository and to the commit it was created from.
Closes #1963
Screenshots (if appropriate)