feat: add npm package provenance

Ref: https://github.blog/2023-04-19-introducing-npm-package-provenance/

Author: theoludwig

.github/workflows/lint.yml

@@ -12,14 +12,14 @@ jobs:
     steps:
       - uses: 'actions/[email protected]'
 
-      - name: 'Use Node.js'
+      - name: 'Setup Node.js'
         uses: 'actions/[email protected]'
         with:
           node-version: 'lts/*'
           cache: 'npm'
 
-      - name: 'Install'
-        run: 'npm install'
+      - name: 'Install dependencies'
+        run: 'npm clean-install'
 
       - run: 'npm run lint:commit -- --to "${{ github.sha }}"'
       - run: 'npm run lint:editorconfig'

.github/workflows/release.yml

@@ -7,20 +7,28 @@ on:
 jobs:
   release:
     runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      issues: 'write'
+      pull-requests: 'write'
+      id-token: 'write'
     steps:
       - uses: 'actions/[email protected]'
         with:
           fetch-depth: 0
           persist-credentials: false
 
-      - name: 'Use Node.js'
+      - name: 'Setup Node.js'
         uses: 'actions/[email protected]'
         with:
           node-version: 'lts/*'
           cache: 'npm'
 
-      - name: 'Install'
-        run: 'npm install'
+      - name: 'Install dependencies'
+        run: 'npm clean-install'
+
+      - name: 'Verify the integrity of provenance attestations and registry signatures for installed dependencies'
+        run: 'npm audit signatures'
 
       - name: 'Release'
         run: 'npm run release'

.github/workflows/test.yml

@@ -12,14 +12,14 @@ jobs:
     steps:
       - uses: 'actions/[email protected]'
 
-      - name: 'Use Node.js'
+      - name: 'Setup Node.js'
         uses: 'actions/[email protected]'
         with:
           node-version: 'lts/*'
           cache: 'npm'
 
-      - name: 'Install'
-        run: 'npm install'
+      - name: 'Install dependencies'
+        run: 'npm clean-install'
 
       - name: 'Test'
         run: 'npm run test'

.npmrc

@@ -1 +1,2 @@
 save-exact=true
+provenance=true

package-lock.json

@@ -27,9 +27,13 @@
     "index.js",
     ".eslintrc.json"
   ],
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
   "engines": {
     "node": ">=16.0.0",
-    "npm": ">=8.0.0"
+    "npm": ">=9.0.0"
   },
   "scripts": {
     "lint:commit": "commitlint",