ci: enable npm provenance in release workflow

Signed-off-by: Ardalan Amini <ardalanamini22@gmail.com>
ardalanamini · Sep 16, 2023 · a71f54c · a71f54c
1 parent 0060ae2
commit a71f54c
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -53,6 +53,10 @@ jobs:
       name: npm
       url: https://www.npmjs.com/package/eslint-config-noir
 
+    permissions:
+      contents: read
+      id-token: write
+
     runs-on: ubuntu-latest
 
     needs:
@@ -95,6 +99,7 @@ jobs:
     permissions:
       contents: read
       packages: write
+      id-token: write
 
     runs-on: ubuntu-latest
 

diff --git a/package.json b/package.json
@@ -65,5 +65,9 @@
     "eslint-plugin-import": "^2.28.1",
     "eslint-plugin-node": "^11.1.0",
     "typescript": "^5.2.2"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
   }
 }