Skip to content

Commit

Permalink
feat(security): Add provenance (#438)
Browse files Browse the repository at this point in the history
* Enable provenance in package.json

* Add necessary permissions to the release workflow
  • Loading branch information
AaronDewes authored and wolfy1339 committed Apr 5, 2024
1 parent f0f82da commit aca91c5
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 1 deletion.
7 changes: 7 additions & 0 deletions .github/workflows/release.yml
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,13 @@ name: Release
- next
- beta
- "*.x"
# These are recommended by the semantic-release docs: https://github.com/semantic-release/npm#npm-provenance
permissions:
contents: write # to be able to publish a GitHub release
issues: write # to be able to comment on released issues
pull-requests: write # to be able to comment on released pull requests
id-token: write # to enable use of OIDC for npm provenance

jobs:
release:
name: release
Expand Down
3 changes: 2 additions & 1 deletion package.json
Original file line number Diff line number Diff line change
@@ -1,7 +1,8 @@
{
"name": "@octokit/auth-oauth-app",
"publishConfig": {
"access": "public"
"access": "public",
"provenance": true
},
"version": "0.0.0-development",
"description": "GitHub OAuth App authentication for JavaScript",
Expand Down

0 comments on commit aca91c5

Please sign in to comment.