Add GitLab CI to the list of supported CI providers for provenance (#686)
Matt Travi committed
Aug 11, 2023 at 17:16 UTC
d73383d27f773f9dcae14b676c755b42d4495149
1 file changed
+1
-1
content/packages-and-modules/securing-your-code/generating-provenance-statements.mdx
+1
-1
@@ -26,7 +26,7 @@ The transparency log service provides a public, verifiable, tamper-evident ledge
26
27
## Provenance limitations
28
29
-- In order to publish a package with provenance, you must build your package with a supported cloud CI/CD provider using a cloud-hosted runner from a public source repository. Today this includes GitHub Actions, and we are collaborating with additional providers to expand support. For more information on how to establish provenance using GitHub Actions, see "[Publishing packages with provenance via GitHub Actions][publishing-with-provenance]."
29
+- In order to publish a package with provenance, you must build your package with a supported cloud CI/CD provider using a cloud-hosted runner from a public source repository. Today this includes GitHub Actions and GitLab CI, and we are collaborating with additional providers to expand support. For more information on how to establish provenance using GitHub Actions, see "[Publishing packages with provenance via GitHub Actions][publishing-with-provenance]."
30
- When a package in the npm registry has established provenance, it does not guarantee the package has no malicious code. Instead, npm provenance provides a verifiable link to the package's source code and build instructions, which developers can then audit and determine whether to trust it or not. For more information, see "[Searching for and choosing packages to download][provenance-info]."
31
32
## Prerequisites