Move GitLab example for npm build provenance (#1066)
<!-- What / Why --> <!-- Describe the request in detail. What it does and why it's being changed. --> When reading the [npm build provenance doc](https://docs.npmjs.com/generating-provenance-statements), I noticed that the GitLab example was under the GitHub Actions section. This PR just moves the GitLab example to the GitLab section of the doc instead. ## References <!-- Examples: Related to #0 Depends on #0 Blocked by #0 Fixes #0 Closes #0 --> I didn't open an issue since it's a tiny, cosmetic change.
Siara committed
Apr 23, 2024 at 07:18 UTC
a9b1439774ac1bb18f5f8e875cf38882190c28b1
1 file changed
+17
-17
content/packages-and-modules/securing-your-code/generating-provenance-statements.mdx
+17
-17
@@ -101,23 +101,6 @@ jobs:
101
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
102
```
103
104
-### Example GitLab CI job
105
-
106
-This example job publishes a package to the npm registry with provenance when a git tag is pushed. Don’t forget to define the `NPM_TOKEN` variable in your GitLab project settings.
107
-
108
-```yaml
109
-publish:
110
- image: 'node:20'
111
- rules:
112
- - if: $CI_COMMIT_TAG
113
- id_tokens:
114
- SIGSTORE_ID_TOKEN:
115
- aud: sigstore
116
- script:
117
- - npm config set //registry.npmjs.org/:_authToken "$NPM_TOKEN"
118
- - npm publish --provenance --access public
119
-```
120
-
104
### Using third-party package publishing tools
105
106
If you publish your packages with tools that do not directly invoke the `npm publish` command, you can do one of the following in your GitHub Actions workflow to publish your packages with provenance.
@@ -144,6 +127,23 @@ If you publish your packages with tools that do not directly invoke the `npm pub
127
128
In order to establish provenance, you must use a supported cloud CI/CD provider and a cloud-hosted runner to publish your packages. GitLab CI/CD is a supported CI/CD platform that allows you to automate software development tasks. For more information, see [Generating provenance in GitLab CI/CD][gitlab-ci-cd-docs] in the GitLab documentation.
129
130
+### Example GitLab CI job
131
+
132
+This example job publishes a package to the npm registry with provenance when a git tag is pushed. Don’t forget to define the `NPM_TOKEN` variable in your GitLab project settings.
133
+
134
+```yaml
135
+publish:
136
+ image: 'node:20'
137
+ rules:
138
+ - if: $CI_COMMIT_TAG
139
+ id_tokens:
140
+ SIGSTORE_ID_TOKEN:
141
+ aud: sigstore
142
+ script:
143
+ - npm config set //registry.npmjs.org/:_authToken "$NPM_TOKEN"
144
+ - npm publish --provenance --access public
145
+```
146
+
147
## Verifying provenance attestations
148
149
You can verify the provenance attestations of downloaded packages with the following `audit` command: