Skip to content

Commit d86fd0b

Browse files
saibotksaibotk
authored
CI: Add provenance to all published packages (#13097)
* CI: Add provenance to all published packages This commit adds provenance for all published packages. See the NPM documentation [0]. Provenance will allow people to verify that the tailwindcss packages were actually built on GH Actions and with the content of the corresponding commit. This will help with supply chain security. For this to work, the `id-token` permission was added only where necessary. [0]: https://docs.npmjs.com/generating-provenance-statements * chore: Add missing repository links to packages This is needed for provenance, to link the repository to the build accoring to the NPM docs [0]. [0]: https://docs.npmjs.com/generating-provenance-statements#prerequisites
1 parent de00a62 commit d86fd0b

File tree

15 files changed

+86
-17
lines changed

15 files changed

+86
-17
lines changed

‎.github/workflows/release-insiders-oxide.yml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -269,6 +269,9 @@ jobs:
269269
runs-on: ubuntu-latest
270270
timeout-minutes: 15
271271
name: Build and release
272+
permissions:
273+
contents: read
274+
id-token: write
272275
needs:
273276
- build
274277
- build-linux
@@ -343,7 +346,7 @@ jobs:
343346
echo "Publishing $pkg..."
344347
cd $pkg
345348
npm version ${{ env.NPM_VERSION }} --force --no-git-tag-version
346-
npm publish --tag ${{ env.RELEASE_CHANNEL }} --access public
349+
npm publish --provenance --tag ${{ env.RELEASE_CHANNEL }} --access public
347350
cd -
348351
done
349352
@@ -352,7 +355,7 @@ jobs:
352355
npm version ${{ env.NPM_VERSION }} --force --no-git-tag-version
353356
sed "s#\"0.0.0\"#\"${{ env.NPM_VERSION }}\"#g" package.json > package_updated.json
354357
mv package_updated.json package.json
355-
npm publish --tag ${{ env.RELEASE_CHANNEL }} --access public
358+
npm publish --provenance --tag ${{ env.RELEASE_CHANNEL }} --access public
356359
cd -
357360
env:
358361
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -361,6 +364,9 @@ jobs:
361364
runs-on: ubuntu-latest
362365
timeout-minutes: 15
363366
name: Build and release Tailwind CSS
367+
permissions:
368+
contents: read
369+
id-token: write
364370

365371
needs:
366372
- release
@@ -401,7 +407,7 @@ jobs:
401407
run: npm version 0.0.0-${{ env.RELEASE_CHANNEL }}.${{ env.SHA_SHORT }} --force --no-git-tag-version
402408

403409
- name: Publish
404-
run: npm publish --tag ${{ env.RELEASE_CHANNEL }}
410+
run: npm publish --provenance --tag ${{ env.RELEASE_CHANNEL }}
405411
env:
406412
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
407413

‎.github/workflows/release-insiders-stable.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ on:
66

77
permissions:
88
contents: read
9+
id-token: write
910

1011
env:
1112
CI: true
@@ -58,7 +59,7 @@ jobs:
5859
run: npm version 0.0.0-${{ env.RELEASE_CHANNEL }}.${{ env.SHA_SHORT }} --force --no-git-tag-version
5960

6061
- name: Publish
61-
run: npm publish --tag ${{ env.RELEASE_CHANNEL }}
62+
run: npm publish --provenance --tag ${{ env.RELEASE_CHANNEL }}
6263
env:
6364
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
6465

‎.github/workflows/release-oxide.yml‎

Lines changed: 9 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -218,6 +218,9 @@ jobs:
218218
runs-on: ubuntu-latest
219219
timeout-minutes: 15
220220
name: Build and release
221+
permissions:
222+
contents: read
223+
id-token: write
221224
needs:
222225
- oxide-build
223226
- oxide-build-linux
@@ -273,7 +276,7 @@ jobs:
273276
echo "Publishing $pkg..."
274277
cd $pkg
275278
npm version ${{ env.NPM_VERSION }} --force --no-git-tag-version
276-
npm publish --tag insiders --access public
279+
npm publish --provenance --tag insiders --access public
277280
cd -
278281
done
279282
@@ -282,7 +285,7 @@ jobs:
282285
npm version ${{ env.NPM_VERSION }} --force --no-git-tag-version
283286
sed "s#\"0.0.0\"#\"${{ env.NPM_VERSION }}\"#g" package.json > package_updated.json
284287
mv package_updated.json package.json
285-
npm publish --tag insiders --access public
288+
npm publish --provenance --tag insiders --access public
286289
cd -
287290
env:
288291
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
@@ -291,6 +294,9 @@ jobs:
291294
runs-on: ubuntu-latest
292295
timeout-minutes: 15
293296
name: Build and release Tailwind CSS
297+
permissions:
298+
contents: read
299+
id-token: write
294300

295301
needs:
296302
- oxide-release
@@ -332,6 +338,6 @@ jobs:
332338
run: npm version 0.0.0-oxide.${{ env.SHA_SHORT }} --force --no-git-tag-version
333339

334340
- name: Publish
335-
run: npm publish --tag oxide
341+
run: npm publish --provenance --tag oxide
336342
env:
337343
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

‎.github/workflows/release-stable.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,7 @@ on:
66

77
permissions:
88
contents: read
9+
id-token: write
910

1011
env:
1112
CI: true
@@ -47,7 +48,7 @@ jobs:
4748
echo "TAILWINDCSS_VERSION=$(node -e 'console.log(require(`./package.json`).version);')" >> $GITHUB_ENV
4849
4950
- name: Publish
50-
run: npm publish --tag ${{ env.RELEASE_CHANNEL }}
51+
run: npm publish --provenance --tag ${{ env.RELEASE_CHANNEL }}
5152
env:
5253
NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
5354

‎oxide/crates/node/npm/darwin-arm64/package.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
{
22
"name": "@tailwindcss/oxide-darwin-arm64",
33
"version": "0.0.0",
4+
"repository": {
5+
"type": "git",
6+
"url": "git+https://github.com/tailwindlabs/tailwindcss.git",
7+
"directory": "oxide/crates/node/npm/darwin-arm64"
8+
},
49
"os": [
510
"darwin"
611
],
@@ -15,4 +20,4 @@
1520
"engines": {
1621
"node": ">= 10"
1722
}
18-
}
23+
}

‎oxide/crates/node/npm/darwin-x64/package.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
{
22
"name": "@tailwindcss/oxide-darwin-x64",
33
"version": "0.0.0",
4+
"repository": {
5+
"type": "git",
6+
"url": "git+https://github.com/tailwindlabs/tailwindcss.git",
7+
"directory": "oxide/crates/node/npm/darwin-x64"
8+
},
49
"os": [
510
"darwin"
611
],
@@ -15,4 +20,4 @@
1520
"engines": {
1621
"node": ">= 10"
1722
}
18-
}
23+
}

‎oxide/crates/node/npm/freebsd-x64/package.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
{
22
"name": "@tailwindcss/oxide-freebsd-x64",
33
"version": "0.0.0",
4+
"repository": {
5+
"type": "git",
6+
"url": "git+https://github.com/tailwindlabs/tailwindcss.git",
7+
"directory": "oxide/crates/node/npm/freebsd-x64"
8+
},
49
"os": [
510
"freebsd"
611
],
@@ -15,4 +20,4 @@
1520
"engines": {
1621
"node": ">= 10"
1722
}
18-
}
23+
}

‎oxide/crates/node/npm/linux-arm-gnueabihf/package.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
{
22
"name": "@tailwindcss/oxide-linux-arm-gnueabihf",
33
"version": "0.0.0",
4+
"repository": {
5+
"type": "git",
6+
"url": "git+https://github.com/tailwindlabs/tailwindcss.git",
7+
"directory": "oxide/crates/node/npm/linux-arm-gnueabihf"
8+
},
49
"os": [
510
"linux"
611
],
@@ -15,4 +20,4 @@
1520
"engines": {
1621
"node": ">= 10"
1722
}
18-
}
23+
}

‎oxide/crates/node/npm/linux-arm64-gnu/package.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
{
22
"name": "@tailwindcss/oxide-linux-arm64-gnu",
33
"version": "0.0.0",
4+
"repository": {
5+
"type": "git",
6+
"url": "git+https://github.com/tailwindlabs/tailwindcss.git",
7+
"directory": "oxide/crates/node/npm/linux-arm64-gnu"
8+
},
49
"os": [
510
"linux"
611
],
@@ -18,4 +23,4 @@
1823
"libc": [
1924
"glibc"
2025
]
21-
}
26+
}

‎oxide/crates/node/npm/linux-arm64-musl/package.json‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,11 @@
11
{
22
"name": "@tailwindcss/oxide-linux-arm64-musl",
33
"version": "0.0.0",
4+
"repository": {
5+
"type": "git",
6+
"url": "git+https://github.com/tailwindlabs/tailwindcss.git",
7+
"directory": "oxide/crates/node/npm/linux-arm64-musl"
8+
},
49
"os": [
510
"linux"
611
],
@@ -18,4 +23,4 @@
1823
"libc": [
1924
"musl"
2025
]
21-
}
26+
}

0 commit comments

Comments
 (0)