publish to NPM with provenance (#1436)

Closes #1404

Author: OmarTawfik

.github/workflows/publish.yml

@@ -24,6 +24,7 @@ jobs:
 
     permissions:
       contents: "write" # to create new branches and releases
+      id-token: "write" # OIDC token for publishing to NPM with provenance
       pull-requests: "write" # to create new pull requests for changesets
 
     steps:

crates/infra/cli/src/commands/publish/npm/mod.rs

@@ -35,6 +35,7 @@ impl NpmController {
 
         let mut command = Command::new("npm")
             .args(["publish", package_dir.unwrap_str()])
+            .flag("--provenance")
             .property("--access", "public");
 
         if self.dry_run.get() {