setup trusted publishers and provenance

[cometkim]

The largest supply chain attack has recently affected many popular packages. It was a simple phishing attack targeted the maintainer's account and 2FA token.

While this doesn't prevent attacks directly targeting maintainers, it does make package usage more secure.

• Trusted publishers allow tokenless workflows via OIDC and prevent abuse of authorized maintainer access tokens.
• Provenance allows you to verify that a version was published through a reviewed workflow.

administration guide:

• Set up the trusted publisher first in the NPM package settings page. (I don't have permission, maybe @cknitt has?)
• Disallow publishing via token, bypassing the 2FA.
• Remove the NPM token from this repository's secrets.

[pkg-pr-new]

Open in StackBlitz

rescript

npm i https://pkg.pr.new/rescript-lang/rescript@7867

@rescript/darwin-arm64

npm i https://pkg.pr.new/rescript-lang/rescript/@rescript/darwin-arm64@7867

@rescript/darwin-x64

npm i https://pkg.pr.new/rescript-lang/rescript/@rescript/darwin-x64@7867

@rescript/linux-arm64

npm i https://pkg.pr.new/rescript-lang/rescript/@rescript/linux-arm64@7867

@rescript/linux-x64

npm i https://pkg.pr.new/rescript-lang/rescript/@rescript/linux-x64@7867

@rescript/runtime

npm i https://pkg.pr.new/rescript-lang/rescript/@rescript/runtime@7867

@rescript/win32-x64

npm i https://pkg.pr.new/rescript-lang/rescript/@rescript/win32-x64@7867

commit: cc5393f

[cknitt]

Remove the NPM token from this repository's secrets.

I think we can keep it until we have confirmed that the new workflow works fine (or even until it expires, it won't be accepted for publishing packages anymore anyway after the setting changes).

[cometkim]

Please let me know if the workflow doesn't work. @cknitt Are you manually assigning the latest tag? That will need to be automated, too.

[cknitt]

@cometkim Yes, currently assigning it manually, see https://github.com/rescript-lang/rescript/blob/master/CONTRIBUTING.md#release-process.

The idea was that we could test the newly released version first before switching it "live".

I think we can keep doing that though (not with a token, but with credentials and 2FA)?

What would be your suggestion for automation?

[cometkim]

Manual publishing with 2FA is fine, but provenance is unavailable. I'm not sure if it also applies to the dist-tag command.
If necessary, it's not too difficult to create a custom workflow_dispatch trigger fot it.

[cometkim]

Let's check it out in the next beta release. Let me know if the npm dist-tag add command fails.