NPM has support for github CI provenance. So you can verify that the package on npm was built on the github actions of the repo mentioned in npm.
back
1 comments
I saw, nice
It seems to not check it automatically, though?
Yeah, you have to set provenance flag to true.
- uses: JS-DevTools/npm-publish@v2
with:
token: ${{ secrets.NPM_TOKEN }}
access: public
provenance: true