GitHub Actions npm Package Publish with Sigstore Provenance

Supanote Core Team @supanote · 1 min read

plain (yaml) 13 hours ago · 28 lines · 6 views

name: Publish to npm
on:
  release:
    types: [published]

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      id-token: write

    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: 20
          registry-url: 'https://registry.npmjs.org'

      - run: npm ci
      - run: npm test
      - run: npm run build

      - name: Publish package with provenance
        run: npm publish --provenance --access public
        env:
          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

1name: Publish to npm

2on:

3 release:

4 types: [published]

6jobs:

7 publish:

8 runs-on: ubuntu-latest

9 permissions:

10 contents: read

11 id-token: write

13 steps:

14 - uses: actions/checkout@v4

15 - uses: actions/setup-node@v4

16 with:

17 node-version: 20

18 registry-url: 'https://registry.npmjs.org'

20 - run: npm ci

21 - run: npm test

22 - run: npm run build

24 - name: Publish package with provenance

25 run: npm publish --provenance --access public

26 env:

27 NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Replies 0

Reply with note

No replies yet

Every reply is a note. Start a discussion, ask a question, or attach a code snippet.

Reply with a note