From 6aac7fd3495bccb3646babc9736f766eb786d1bd Mon Sep 17 00:00:00 2001 From: Jorge Soares Date: Sun, 14 Dec 2025 00:57:42 +0000 Subject: [PATCH 1/2] fix: Add `npm audit signatures` to release workflow and configure `semantic-release` npm plugin with `verifyConditions: false`. --- .github/workflows/release-ducjs.yml | 3 ++- packages/ducjs/release.config.cjs | 4 ++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/.github/workflows/release-ducjs.yml b/.github/workflows/release-ducjs.yml index ad71f784..a03349d4 100644 --- a/.github/workflows/release-ducjs.yml +++ b/.github/workflows/release-ducjs.yml @@ -49,7 +49,8 @@ jobs: current-branch: ${{ github.ref_name }} package-name: ducjs - + - name: Verify the integrity of provenance attestations and registry signatures for installed dependencies + run: npm audit signatures - name: Release env: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/packages/ducjs/release.config.cjs b/packages/ducjs/release.config.cjs index d6a07495..8bd6944d 100644 --- a/packages/ducjs/release.config.cjs +++ b/packages/ducjs/release.config.cjs @@ -18,8 +18,8 @@ module.exports = { [ "@semantic-release/npm", { - npmPublish: true, - provenance: true, // Required for OIDC + provenance: true, + verifyConditions: false }, ], "@semantic-release/github", From aa443430c3c99f41aa8f416044458fa1a8bee0da Mon Sep 17 00:00:00 2001 From: Jorge Soares Date: Sun, 14 Dec 2025 00:59:27 +0000 Subject: [PATCH 2/2] ci: Add Node.js setup step to the release workflow. --- .github/workflows/release-ducjs.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/release-ducjs.yml b/.github/workflows/release-ducjs.yml index a03349d4..97df5a74 100644 --- a/.github/workflows/release-ducjs.yml +++ b/.github/workflows/release-ducjs.yml @@ -30,6 +30,10 @@ jobs: run: | git config user.name "GitHub Action" git config user.email "action@github.com" + - name: Setup Node.js + uses: actions/setup-node@v4 + with: + node-version: "lts/*" - name: Setup Bun uses: oven-sh/setup-bun@v2 with: