fix: add provenance

Author: stipsan

.github/workflows/ci.yml

@@ -31,6 +31,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.run_id }}
   cancel-in-progress: true
 
+permissions:
+  contents: read # for checkout
+
 jobs:
   # log-the-inputs:
   #   runs-on: ubuntu-latest
@@ -95,6 +98,11 @@ jobs:
   #         echo "$NEEDS"
 
   release:
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on released pull requests
+      id-token: write # to enable use of OIDC for npm provenance
     needs: test
     # only run if opt-in during workflow_dispatch
     # needs.test.result: 'success' | 'failure' | 'skipped' | 'cancelled'

package.json

@@ -68,6 +68,7 @@
     "node": ">=18"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }