Add example for publishing with GitLab provenance (#684)
Also code blocks in that document were tagged with their language to provide syntax highlighting.
Remco Haszing committed
Aug 8, 2023 at 20:06 UTC
bd017c9f59c1a0da0d4c00648edde571ce8d26c2
1 file changed
+40
-23
content/packages-and-modules/securing-your-code/generating-provenance-statements.mdx
+40
-23
@@ -49,26 +49,26 @@ To update your GitHub Actions workflow to publish your packages with provenance,
49
50
- Give permission to mint an ID-token:
51
52
- ```
52
+ ```yaml
53
permissions:
54
id-token: write
55
```
56
57
- Run on a [GitHub-hosted runner](https://docs.github.com/en/actions/using-github-hosted-runners/about-github-hosted-runners#supported-runners-and-hardware-resources):
58
59
- ```
59
+ ```yaml
60
runs-on: ubuntu-latest
61
```
62
63
- Add the `--provenance` flag to your publish command:
64
65
- ```
65
+ ```sh
66
npm publish --provenance
67
```
68
69
- If you are publishing a package for the first time you will also need to explicitly set access to public:
70
71
- ```
71
+ ```sh
72
npm publish --provenance --access public
73
```
74
@@ -76,28 +76,45 @@ To update your GitHub Actions workflow to publish your packages with provenance,
76
77
This example workflow publishes a package to the npm registry with provenance.
78
79
-```
79
+```yaml
80
name: Publish Package to npmjs
81
on:
82
- release:
83
- types: [created]
82
+ release:
83
+ types: [created]
84
jobs:
85
- build:
86
- runs-on: ubuntu-latest
87
- permissions:
88
- contents: read
89
- id-token: write
90
- steps:
91
- - uses: actions/checkout@v3
92
- - uses: actions/setup-node@v3
93
- with:
94
- node-version: '18.x'
95
- registry-url: 'https://registry.npmjs.org'
96
- - run: npm install -g npm
97
- - run: npm ci
98
- - run: npm publish --provenance --access public
99
- env:
100
- NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
85
+ build:
86
+ runs-on: ubuntu-latest
87
+ permissions:
88
+ contents: read
89
+ id-token: write
90
+ steps:
91
+ - uses: actions/checkout@v3
92
+ - uses: actions/setup-node@v3
93
+ with:
94
+ node-version: '18.x'
95
+ registry-url: 'https://registry.npmjs.org'
96
+ - run: npm install -g npm
97
+ - run: npm ci
98
+ - run: npm publish --provenance --access public
99
+ env:
100
+ NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
101
+```
102
+
103
+### Example GitLab CI job
104
+
105
+This example job publishes a package to the npm registry with provenance when a git tag is pushed. Don’t forget to define the `NPM_TOKEN` variable in your GitLab project settings.
106
+
107
+```yaml
108
+publish:
109
+ image: 'node:20'
110
+ rules:
111
+ - if: $CI_COMMIT_TAG
112
+ id_tokens:
113
+ SIGSTORE_ID_TOKEN:
114
+ aud: sigstore
115
+ script:
116
+ - npm config set //registry.npmjs.org/:_authToken "$NPM_TOKEN"
117
+ - npm publish --provenance --access publich
118
```
119
120
### Using third-party package publishing tools