feat: sign npm package

[JamieMagee]

Changes

Sign Renovate packages when published

Context

https://github.blog/2023-04-19-introducing-npm-package-provenance/

• closes Sign our own npm package #19170

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests but ran on a real repository, or
• Both unit tests + ran on a real repository

[viceice]

are you sure this works with semantic release and will not blocked by npmjs?

[JamieMagee]

are you sure this works with semantic release and will not blocked by npmjs?

semantic release uses npm directly to publish¹ so it should work. And this feature is in public preview, so no configuration required. I just published @jamiemagee/provenance from GitHub actions with no configuration.

Footnotes

1. https://github.com/semantic-release/npm/blob/9aa8c5e7874e4d550da395ffca4a4626dd001d2a/lib/publish.js#L23-L27 ↩

[JamieMagee]

I'm going ahead with the merge, and will closely monitor the package publish.

[renovate-release]

🎉 This PR is included in version 35.55.0 🎉

The release is available on:

• GitHub release
• 35.55.0

Your semantic-release bot 📦🚀

[travi]

excited to see you adopting this so quickly. i haven't even had the chance to update the docs for semantic-release for this quite yet. i can confirm that setting either in the .npmrc, like you have, or setting in publishConfig within the package.json both work as intended with semantic-release

[rarkins]

The publish failed:

npm notice 
npm notice Publishing to https://registry.npmjs.org/ with tag latest and default access
npm ERR! code EUSAGE
npm ERR! Automatic provenance generation not supported outside of GitHub Actions

npm ERR! A complete log of this run can be found in:
npm ERR!     /home/runner/.npm/_logs/2023-04-19T19_35_38_672Z-debug-0.log
Error: Process completed with exit code 1.

https://github.com/renovatebot/renovate/actions/runs/4747207723/jobs/8431810108

[JamieMagee]

@rarkins fixed in #21612 already