Merge pull request #1542 from Automattic/add/npm-provenance

chore: generate and verify provenance statements

.github/workflows/ci.yml

@@ -42,6 +42,26 @@ jobs:
       - name: Run ${{ matrix.config.tool }}
         run: npm run '${{ matrix.config.tool }}'
 
+  audit:
+    name: Verify signatures and provenance statements
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check out the source code
+        uses: actions/checkout@v3
+
+      - name: Set up Node.js environment
+        uses: actions/setup-node@v3
+        with:
+          node-version: lts/*
+          cache: npm
+          cache-dependency-path: npm-shrinkwrap.json
+
+      - name: Install dependencies
+        run: npm ci
+
+      - name: Run audit
+        run: npm audit signatures
+
   test:
     name: Run tests
     runs-on: ubuntu-latest

package.json

@@ -186,6 +186,7 @@
     }
   },
   "publishConfig": {
-    "access": "public"
+    "access": "public",
+    "provenance": true
   }
 }