Verifying provenance attestations (#26)

Author: aivus

.github/workflows/publish.yml

@@ -46,6 +46,9 @@ jobs:
       - name: Install dependencies
         run: npm install
 
+      - name: Verifying provenance attestations
+        run: npm audit signatures
+
       - name: Bump version and create tag
         id: bump-version
         run: |

.github/workflows/test-compatibility.yaml

@@ -40,9 +40,15 @@ jobs:
         with:
           node-version: '22'
 
+      - name: Update npm
+        run: npm install -g npm@latest
+
       - name: Install dependencies
         run: npm install
 
+      - name: Verifying provenance attestations
+        run: npm audit signatures
+
       - name: Install version wrapper package from the branch
         run: npm install website-scraper/puppeteer-version-wrapper#${{ github.head_ref }} --save