From b28ee220ca96db44a8555551ccd6cf06c8b37052 Mon Sep 17 00:00:00 2001 From: Aaron Dewes Date: Wed, 3 Apr 2024 20:12:30 +0200 Subject: [PATCH] feat(security): Add provenance (#916) * Enable provenance in package.json * Add necessary permissions to the release workflow * Adapt PR --------- Co-authored-by: wolfy1339 --- .github/workflows/release.yml | 7 +++++++ package.json | 3 --- payload-examples/package.json | 3 ++- payload-schemas/package.json | 3 ++- payload-types/package.json | 3 ++- 5 files changed, 13 insertions(+), 6 deletions(-) diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 58cf39842..56b814069 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -4,6 +4,13 @@ - main - beta name: Release +# These are recommended by the semantic-release docs: https://github.com/semantic-release/npm#npm-provenance +permissions: + contents: write # to be able to publish a GitHub release + issues: write # to be able to comment on released issues + pull-requests: write # to be able to comment on released pull requests + id-token: write # to enable use of OIDC for npm provenance + jobs: build: name: release diff --git a/package.json b/package.json index 908b0c2ce..069b78c15 100644 --- a/package.json +++ b/package.json @@ -91,8 +91,5 @@ "turndown": "^7.1.1", "typescript": "^5.0.0", "yargs": "^17.3.1" - }, - "publishConfig": { - "access": "public" } } diff --git a/payload-examples/package.json b/payload-examples/package.json index 2690845fa..82df8fd5f 100644 --- a/payload-examples/package.json +++ b/payload-examples/package.json @@ -18,6 +18,7 @@ }, "devDependencies": {}, "publishConfig": { - "access": "public" + "access": "public", + "provenance": true } } diff --git a/payload-schemas/package.json b/payload-schemas/package.json index 4a2d37062..b957a0428 100644 --- a/payload-schemas/package.json +++ b/payload-schemas/package.json @@ -14,6 +14,7 @@ "dependencies": {}, "devDependencies": {}, "publishConfig": { - "access": "public" + "access": "public", + "provenance": true } } diff --git a/payload-types/package.json b/payload-types/package.json index cd05b03bf..f3e51d9c5 100644 --- a/payload-types/package.json +++ b/payload-types/package.json @@ -15,6 +15,7 @@ "dependencies": {}, "devDependencies": {}, "publishConfig": { - "access": "public" + "access": "public", + "provenance": true } }