Skip to content

Commit 4f715ec

Browse files
authored
docs: update generating-provenance-statements page (#1182)
<!-- What / Why --> <!-- Describe the request in detail. What it does and why it's being changed. --> This PR updates the "Generating provenance statements" page, updating the GitHub action and introducing minor fixes to the page. > [!NOTE] > I have removed the` - run: npm install -g npm` line from the GitHub action since `actions/setup-node` will perform the same. ## References <!-- Examples: Related to #0 Depends on #0 Blocked by #0 Fixes #0 Closes #0 --> N/A --------- Signed-off-by: K.B.Dharun Krishna <[email protected]>
1 parent 05efae1 commit 4f715ec

File tree

1 file changed

+7
-5
lines changed

1 file changed

+7
-5
lines changed

content/packages-and-modules/securing-your-code/generating-provenance-statements.mdx

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -89,12 +89,11 @@ jobs:
8989
contents: read
9090
id-token: write
9191
steps:
92-
- uses: actions/checkout@v3
93-
- uses: actions/setup-node@v3
92+
- uses: actions/checkout@v4
93+
- uses: actions/setup-node@v4
9494
with:
95-
node-version: '18.x'
95+
node-version: '20.x'
9696
registry-url: 'https://registry.npmjs.org'
97-
- run: npm install -g npm
9897
- run: npm ci
9998
- run: npm publish --provenance --access public
10099
env:
@@ -107,12 +106,15 @@ If you publish your packages with tools that do not directly invoke the `npm pub
107106

108107
- **Configure environment variables:** In your GitHub Actions workflow, you can use an environment variable called `NPM_CONFIG_PROVENANCE`, and set it to `true`.
109108
- **Configure your `package.json` file:** You can add a `publishConfig` block to your `package.json` file:
109+
110110
```json
111111
"publishConfig": {
112112
"provenance": true
113113
},
114114
```
115+
115116
- **Add an `.npmrc` file:** You can add an `.npmrc` file to your project with the following entry:
117+
116118
```ini
117119
provenance=true
118120
```
@@ -129,7 +131,7 @@ In order to establish provenance, you must use a supported cloud CI/CD provider
129131

130132
### Example GitLab CI job
131133

132-
This example job publishes a package to the npm registry with provenance when a git tag is pushed. Dont forget to define the `NPM_TOKEN` variable in your GitLab project settings.
134+
This example job publishes a package to the npm registry with provenance when a git tag is pushed. Don't forget to define the `NPM_TOKEN` variable in your GitLab project settings.
133135

134136
```yaml
135137
publish:

0 commit comments

Comments
 (0)