Merge pull request #2798 from Akshat55/provenance

ci: Publish packages to npm with provenance statements
carbon-design-system · Feb 29, 2024 · 6ecca36 · 6ecca36
2 parents 00e300f + ba939c1
commit 6ecca36
Show file tree

Hide file tree

Showing 3 changed files with 1,827 additions and 2,716 deletions.
diff --git a/.github/workflows/publish.yml b/.github/workflows/publish.yml
@@ -8,12 +8,20 @@ on:
   # Allows us to run this workflow manually from the Actions tab
   workflow_dispatch:
 
+permissions:
+  contents: read # for checkout
+
 jobs:
   # Single deploy job since we're just deploying
   publish:
     environment:
       name: Deploy
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # to be able to publish a GitHub release
+      issues: write # to be able to comment on released issues
+      pull-requests: write # to be able to comment on pull requests
+      id-token: write # to enable use of ODIC for npm provenance
     steps:
       # Checkout to branch
       - name: Checkout