ci: 👷 release with provenance statements

DerZade · Apr 22, 2024 · 1e998fa · 1e998fa
1 parent 0e05142
commit 1e998fa
Showing 1 changed file with 11 additions and 7 deletions.
diff --git a/.github/workflows/RELEASE.yml b/.github/workflows/RELEASE.yml
@@ -7,20 +7,24 @@ on:
 jobs:
     publish_to_npm:
         runs-on: ubuntu-latest
+        permissions:
+            contents: read
+            id-token: write
         steps:
-            - uses: actions/checkout@v3
+            - uses: actions/checkout@v4
 
-            - uses: actions/setup-node@v3
+            - uses: actions/setup-node@v4
               with:
-                  node-version: 16
+                  node-version: '20.x'
+                  registry-url: 'https://registry.npmjs.org'
                   cache: 'npm'
 
             - name: Install dependencies
-              run: npm ci --ignore-scripts
+              run: npm ci
 
             - name: Build app
               run: npm run-script build
 
-            - uses: JS-DevTools/npm-publish@v1
-              with:
-                  token: ${{ secrets.NPM_TOKEN }}
+            - run: npm publish --provenance
+              env:
+                  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}