chore(ci): enable npm package provenance

Aashu-Dubey · May 14, 2023 · f8c3921 · f8c3921
1 parent 0a8fdeb
commit f8c3921
Showing 1 changed file with 9 additions and 3 deletions.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -27,7 +27,7 @@ jobs:
           cache: 'yarn'
 
       - name: Install packages
-        run: yarn
+        run: yarn install --frozen-lockfile
 
       - name: Build the plugin
         run: yarn build
@@ -41,6 +41,8 @@ jobs:
     name: Publish package to npmjs
     runs-on: ubuntu-latest
     needs: publish-gh-packages
+    permissions:
+      id-token: write
 
     steps:
       - uses: actions/checkout@v3
@@ -53,13 +55,17 @@ jobs:
           registry-url: 'https://registry.npmjs.org'
           cache: 'yarn'
 
+      # package provenance requires latest npm, alternatively we can probably use node 18 above instead
+      - name: Install latest npm
+        run: npm install -g npm@latest
+
       - name: Install packages
-        run: yarn
+        run: yarn install --frozen-lockfile
 
       - name: Build the plugin
         run: yarn build
 
       - name: Publish Package
-        run: npm publish
+        run: npm publish --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}