Use provenance when publishing

dgreif · Oct 14, 2024 · f0dba40 · f0dba40
1 parent 476cfc0
commit f0dba40
Show file tree

Hide file tree

Showing 2 changed files with 12 additions and 1 deletion.
diff --git a/.changeset/nine-jobs-sneeze.md b/.changeset/nine-jobs-sneeze.md
@@ -0,0 +1,6 @@
+---
+'homebridge-ring': patch
+'ring-client-api': patch
+---
+
+Use `provenance` when publishing to npm
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -7,6 +7,10 @@ on:
 
 concurrency: ${{ github.workflow }}-${{ github.ref }}
 
+permissions:
+  contents: read
+  id-token: write # needed for provenance
+
 jobs:
   release:
     name: Release
@@ -25,7 +29,7 @@ jobs:
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
-          node-version: 18.x
+          node-version: 22.x
           cache: 'npm'
 
       - name: Install Dependencies
@@ -38,3 +42,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GH_TOKEN_CHANGESETS }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true