ci: add npm provenance

.github/workflows/npm-publish.yml

@@ -4,32 +4,35 @@ on:
   workflow_call:
     inputs:
       tag:
-        description: 'Release tag to publish (e.g., v1.0.0)'
+        description: "Release tag to publish (e.g., v1.0.0)"
         required: true
         type: string
   workflow_dispatch:
     inputs:
       tag:
-        description: 'Release tag to publish (e.g., v1.0.0)'
+        description: "Release tag to publish (e.g., v1.0.0)"
         required: true
         type: string
 
 jobs:
   npm-publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     env:
       NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
     steps:
       - uses: actions/checkout@v4
         with:
           ref: ${{ inputs.tag }}
-      
+
       - name: Set up Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 22
-          registry-url: 'https://registry.npmjs.org'
-      
+          registry-url: "https://registry.npmjs.org"
+
       - name: Download release assets
         run: |
           TAG="${{ inputs.tag }}"
@@ -50,12 +53,13 @@ jobs:
           for platform_dir in platform-packages/go-blueprint-*; do
             if [ -d "$platform_dir" ]; then
               cd "$platform_dir"
-              npm publish --access public
+              npm publish --provenance --access public
               cd - > /dev/null
             fi
           done
 
       - name: Publish main package to npm
         run: |
           cd npm-package
-          npm publish --access public
+          npm publish --provenance --access public
+

.github/workflows/release.yml

@@ -16,9 +16,8 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v4
         with:
-          go-version: '1.21.1'
-      -
-        name: Run GoReleaser
+          go-version: "1.21.1"
+      - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v5.0.0
         with:
           distribution: goreleaser
@@ -30,7 +29,11 @@ jobs:
 
   npm-publish:
     needs: goreleaser
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/npm-publish.yml
     with:
       tag: ${{ github.ref_name }}
-    secrets: inherit
+    secrets: inherit
+