docs: update generating-provenance-statements page (#1182)
<!-- What / Why --> <!-- Describe the request in detail. What it does and why it's being changed. --> This PR updates the "Generating provenance statements" page, updating the GitHub action and introducing minor fixes to the page. > [!NOTE] > I have removed the` - run: npm install -g npm` line from the GitHub action since `actions/setup-node` will perform the same. ## References <!-- Examples: Related to #0 Depends on #0 Blocked by #0 Fixes #0 Closes #0 --> N/A --------- Signed-off-by: K.B.Dharun Krishna <kbdharunkrishna@gmail.com>
K.B.Dharun Krishna committed
Jul 4, 2024 at 00:01 UTC
4f715ec2f53dc6429dbc8120a9e42b819680749c
1 file changed
+7
-5
content/packages-and-modules/securing-your-code/generating-provenance-statements.mdx
+7
-5
@@ -89,12 +89,11 @@ jobs:
89
contents: read
90
id-token: write
91
steps:
92
- - uses: actions/checkout@v3
93
- - uses: actions/setup-node@v3
92
+ - uses: actions/checkout@v4
93
+ - uses: actions/setup-node@v4
94
with:
95
- node-version: '18.x'
95
+ node-version: '20.x'
96
registry-url: 'https://registry.npmjs.org'
97
- - run: npm install -g npm
97
- run: npm ci
98
- run: npm publish --provenance --access public
99
env:
@@ -107,12 +106,15 @@ If you publish your packages with tools that do not directly invoke the `npm pub
106
107
- **Configure environment variables:** In your GitHub Actions workflow, you can use an environment variable called `NPM_CONFIG_PROVENANCE`, and set it to `true`.
108
- **Configure your `package.json` file:** You can add a `publishConfig` block to your `package.json` file:
109
+
110
```json
111
"publishConfig": {
112
"provenance": true
113
},
114
```
115
+
116
- **Add an `.npmrc` file:** You can add an `.npmrc` file to your project with the following entry:
117
+
118
```ini
119
provenance=true
120
```
@@ -129,7 +131,7 @@ In order to establish provenance, you must use a supported cloud CI/CD provider
131
132
### Example GitLab CI job
133
132
-This example job publishes a package to the npm registry with provenance when a git tag is pushed. Don’t forget to define the `NPM_TOKEN` variable in your GitLab project settings.
134
+This example job publishes a package to the npm registry with provenance when a git tag is pushed. Don't forget to define the `NPM_TOKEN` variable in your GitLab project settings.
135
136
```yaml
137
publish: