Merge pull request #102 from SocketDev/release-provenance

npm provenance GH action

Author: bmeck

.github/workflows/provenance.yml

@@ -0,0 +1,26 @@
+name: Publish Package to npmjs
+
+on:
+ release:
+   types: [created]
+
+jobs:
+ build:
+   runs-on: ubuntu-latest
+
+   permissions:
+     contents: read
+     id-token: write
+
+   steps:
+     - uses: actions/checkout@v3
+     - uses: actions/setup-node@v3
+       with:
+         node-version: '18'
+         registry-url: 'https://registry.npmjs.org'
+         cache: npm
+     - run: npm install -g npm@latest
+     - run: npm install
+     - run: npm publish --provenance --access public
+       env:
+         NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

CONTRIBUTING.md

@@ -0,0 +1,3 @@
+# Publishing a new version
+
+This repository uses `npm` provided provenance using GitHub Actions, please update the version in `package.json` using an appropriate tag and create a release using GitHub, the `.github/workflows/provenance.yml` action should publish it to `npm` from there.