Tim van der Meij
7114796430
Merge pull request #18352 from wojtekmaj/provenance
...
Generate provenance statements on npm publish
2024-07-01 17:42:16 +02:00
Wojciech Maj
aaa65bf3fc
Generate provenance statements on npm publish
...
This PR adds [Provenance statements](https://docs.npmjs.com/generating-provenance-statements ) on `npm publish`, increasing supply-chain security.
2024-07-01 15:37:25 +02:00
Wojciech Maj
6b449d8884
Use npm ci, not npm install, on CI
...
This PR switches from `npm install` to `npm ci` on CI. This enables some additional checks to ensure repo integrity when using CI/CD.
Read more: https://docs.npmjs.com/cli/v10/commands/npm-ci
2024-07-01 13:46:23 +02:00
Tim van der Meij
a5f2b9faeb
Introduce a GitHub Actions workflow for publishing a release
...
This commit migrates this functionality away from the bots. Note that
the NPM token must be configured as a repository secret before this
workflow can execute.
The following resources are relevant for this patch:
- Publishing packages to the NPM registry:
https://docs.github.com/en/actions/publishing-packages/publishing-nodejs-packages#publishing-packages-to-the-npm-registry
- Creating secrets for a repository:
https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#creating-secrets-for-a-repository
2024-06-30 16:03:52 +02:00
