chore: add SLSA provenance for NPM artifacts

# Conflicts: # .github/workflows/make_release.yml
zama-ai · Jul 17, 2024 · 4342efe · 4342efe
1 parent a3ec847
commit 4342efe
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/.github/workflows/make_release.yml b/.github/workflows/make_release.yml
@@ -33,6 +33,9 @@ jobs:
   publish_release:
     name: Publish Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout
         uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332
@@ -65,6 +68,7 @@ jobs:
           package: tfhe/pkg/package.json
           dry-run: ${{ inputs.dry_run }}
           tag: ${{ env.NPM_TAG }}
+          provenance: true
 
       - name: Build Node package
         if: ${{ inputs.push_node_package }}
@@ -82,6 +86,7 @@ jobs:
           package: tfhe/pkg/package.json
           dry-run: ${{ inputs.dry_run }}
           tag: ${{ env.NPM_TAG }}
+          provenance: true
 
       - name: Slack Notification
         if: ${{ failure() }}