3 ms·
NPM has support for github CI provenance. So you can verify that the package on npm was built on the github actions of the repo mentioned in npm.
by porridgeraisin 2y ago
NPM has support for github CI provenance. So you can verify that the package on npm was built on the github actions of the repo mentioned in npm.
- g-b-r 2y agoI saw, nice It seems to not check it automatically, though?
- porridgeraisin 2y agoYeah, you have to set provenance flag to true. - uses: JS-DevTools/npm-publish@v2 with: token: ${{ secrets.NPM_TOKEN }} access: public provenance: true For example