feat: add npm package provenance

Ref: https://github.blog/2023-04-19-introducing-npm-package-provenance/

.github/workflows/release.yml

@@ -7,6 +7,11 @@ on:
 jobs:
   release:
     runs-on: 'ubuntu-latest'
+    permissions:
+      contents: 'write'
+      issues: 'write'
+      pull-requests: 'write'
+      id-token: 'write'
     steps:
       - uses: 'actions/checkout@v3.5.2'
         with:
@@ -27,6 +32,9 @@ jobs:
 
       - run: 'npm run build:typescript'
 
+      - name: 'Verify the integrity of provenance attestations and registry signatures for installed dependencies'
+        run: 'npm audit signatures'
+
       - name: 'Release'
         run: 'npm run release'
         env:

.github/workflows/tests.yml

@@ -32,7 +32,7 @@ jobs:
     steps:
       - uses: 'actions/checkout@v3.5.2'
 
-      - name: 'Use Docker'
+      - name: 'Setup Docker'
         uses: 'actions-hub/docker/cli@master'
         env:
           SKIP_LOGIN: true

.npmrc

@@ -1,2 +1,3 @@
 save-exact=true
 engine-strict=true
+provenance=true

package.json

@@ -32,7 +32,8 @@
     "npm": ">=8.0.0"
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   },
   "files": [
     "build"