Add provenance to GitLab OIDC example (#1800)
The GitLab OIDC example was missing the `SIGSTORE_ID_TOKEN`, which is needed for publishing provenance, also with OIDC. ## References Closes https://github.com/npm/cli/issues/8558
Remco Haszing committed
Dec 4, 2025 at 18:04 UTC
5c9482822b1d60cd57c42fbb74e55780499f7e14
1 file changed
+2
content/packages-and-modules/securing-your-code/trusted-publishers.mdx
+2
@@ -131,6 +131,8 @@ publish:
131
id_tokens:
132
NPM_ID_TOKEN:
133
aud: "npm:registry.npmjs.org"
134
+ SIGSTORE_ID_TOKEN:
135
+ aud: sigstore
136
script:
137
# Ensure npm 11.5.1 or later is installed
138
- npm install -g npm@latest