Publishing npm Packages with Provenance

Description and use

<h2> Why provenance </h2> <p>Publishing from GitHub Actions with <code>--provenance</code> takes one extra flag and one permission line. In return, every version on npm links back to the exact commit and workflow run that built it.</p> <p>Without provenance, a package on npm is just a tarball someone uploaded. Nothing proves it matches the source on GitHub. A provenance statement is a signed attestation, logged in the public Sigstore transparency log. It records which repo, commit and workflow produced the tarball. npmjs.com then shows a green "Built and signed on GitHub Actions" badge.</p> <p

Problem

<h2> Why provenance </h2> <p>Publishing from GitHub Actions with <code>--provenance</code> takes one extra flag and one permission line. In return, every version on npm links back to the exact commit and workflow run that built it.</p> <p>Without provenance, a package on npm is just a tarball someone uploaded. Nothing proves it matches the source on GitHub. A provenance statement is a signed attestation, logged in the public Sigstore transparency log. It records which repo, commit and workflow produced the tarball. npmjs.com then shows a green "Built and signed on GitHub Actions" badge.</p> <p

Outcome

<h2> Why provenance </h2> <p>Publishing from GitHub Actions with <code>--provenance</code> takes one extra flag and one permission line. In return, every version on npm links back to the exact commit and workflow run that built it.</p> <p>Without provenance, a package on npm is just a tarball someone uploaded. Nothing proves it matches the source on GitHub. A provenance statement is a signed attestation, logged in the public Sigstore transparency log. It records which repo, commit and workflow produced the tarball. npmjs.com then shows a green "Built and signed on GitHub Actions" badge.</p> <p

Evidence

Publishing npm Packages with Provenance

Source