update package-lock.json, add provenance

checkdigit · Jan 8, 2024 · 35f6ab7 · 35f6ab7
1 parent af78fd3
commit 35f6ab7
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 9 deletions.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -7,6 +7,9 @@ on:
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     name: Publish to NPM
     steps:
       - uses: actions/checkout@v3
@@ -21,6 +24,6 @@ jobs:
       - name: Run Test
         run: npm run test
       - name: Publish
-        run: npm publish
+        run: npm publish --provenance
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_PUBLISH }}
diff --git a/package-lock.json b/package-lock.json