ci: 👷 release with provenance statements

Signed-off-by: DerZade <[email protected]>
arma-events · Apr 22, 2024 · b33f315 · b33f315
1 parent 302d62c
commit b33f315
Showing 1 changed file with 10 additions and 3 deletions.
diff --git a/.github/workflows/RELEASE.yml b/.github/workflows/RELEASE.yml
@@ -7,17 +7,24 @@ on:
 jobs:
     publish_to_npm:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write
         steps:
             - uses: actions/checkout@v4
 
             - uses: actions/setup-node@v4
               with:
                   node-version: 20
+                  registry-url: 'https://registry.npmjs.org'
                   cache: 'npm'
 
             - name: Install dependencies
               run: npm ci --ignore-scripts
 
-            - uses: JS-DevTools/npm-publish@v3
-              with:
-                  token: ${{ secrets.NPM_TOKEN }}
+            - name: Build app
+              run: npm run-script build
+
+            - run: npm publish --provenance
+              env:
+                  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}