Default to publishing with provenance in npm publish workflow #2347
+3
−3
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Pre-requisites
Please note that at this time we are only accepting new starter workflows for Code Scanning. Updates to existing starter workflows are fine.
Tasks
For all workflows, the workflow:
.yml
file with the language or platform as its filename, in lower, kebab-cased format (for example,docker-image.yml
). Special characters should be removed or replaced with words as appropriate (for example, "dotnet" instead of ".NET").GITHUB_TOKEN
so that the workflow runs successfully.For CI workflows, the workflow:
ci
directory.ci/properties/*.properties.json
file (for example,ci/properties/docker-publish.properties.json
).push
tobranches: [ $default-branch ]
andpull_request
tobranches: [ $default-branch ]
.release
withtypes: [ created ]
.docker-publish.yml
).Some general notes:
actions
organization, orDescription
Update the
npm-publish.yml
starter workflow to publish with provenance to encourage users publishing to npm to use provenance. The implementation is based on (but improved compared to) the example found at https://docs.npmjs.com/generating-provenance-statements (accessed March 20, 2024, copied below). A prerequisite for this is upgrading Node.js to v20 because it ships with an npm version that supports the--provenance
flag.I can see this being in violation with "Automation and CI workflows should not send data to any 3rd party service except for the purposes of installing dependencies." which is why I didn't mark it. If it is, feel free to reject this.
Part of the changes here are covered by #2269
workflow from npm docs