Support publishing packages with provenance

[Yang-33]

By enabling the --provenance flag during npm publish, our package now includes a verifiable record of its build process, enhancing supply chain security. This helps others confirm the authenticity and integrity of the package, ensuring greater trustworthiness in the ecosystem.

See

• https://docs.npmjs.com/generating-provenance-statements#publishing-packages-with-provenance-via-github-actions
• https://github.blog/security/supply-chain-security/introducing-npm-package-provenance/

[Yang-33]

I'm not sure if this works, so please proceed other releases. After all releases are completed, I'll merge this change and test publishing.

[Yang-33]

I'll look into it a bit more to ensure that this build step is acceptable for publish with the provenance, as my understanding is still a bit unclear.

line-bot-sdk-nodejs/.github/workflows/release.yml

Lines 22 to 34 in d4ee02c

	- name: Update version in package.json, package-lock.json, and lib/version.ts
	run: |
	if [ "${{ github.event_name }}" == "workflow_dispatch" ]; then
	VERSION=${{ github.event.inputs.version }}
	else
	VERSION=${{ github.event.release.tag_name }}
	fi
	VERSION=${VERSION#v}
	echo "VERSION=$VERSION" >> $GITHUB_ENV
	node ./scripts/update-version.mjs $VERSION
	- run: npm run release
	env:
	NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN_2 }}

[Yang-33]

ok, changing certain files before publishing may not be an issue. We only modify metadata, leaving core functionality unchanged, and this process is documented in our release workflow, ensuring transparency and reproducibility.

[Yang-33]

Result

(1) sigstore log: https://search.sigstore.dev/?logIndex=171258206
(2) npm shows verification mark

(3) npm shows some detailed info in Provenance section: https://www.npmjs.com/package/@line/bot-sdk/v/9.7.1#provenance