Add support for npm provenance

wojtekmaj · Oct 18, 2023 · 5c67234 · 5c67234
1 parent e72e9b4
commit 5c67234
Showing 1 changed file with 8 additions and 4 deletions.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -33,21 +33,25 @@ jobs:
         uses: actions/setup-node@v3
         with:
           node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
 
       - name: Enable Corepack
         run: corepack enable
 
       - name: Install dependencies
         run: yarn --immutable
 
+      - name: Generate archive
+        run: yarn pack
+
       - name: Publish with latest tag
         if: github.event.release.prelease == false
-        run: yarn npm publish --tag latest
+        run: npm publish package.tgz --tag latest --provenance
         env:
-          YARN_NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Publish with next tag
         if: github.event.release.prelease == true
-        run: yarn npm publish --tag next
+        run: npm publish package.tgz --tag next --provenance
         env:
-          YARN_NPM_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}