Post

daniel r(ooooooh) in nyc 🇺🇸
@danielroe.dev

in light of the current supply chain attacks, I've just published a @github.com action to detect packages that _lose_ their provenance. 📦 supports pnpm-lock.yaml, package-lock.json, yarn.lock (v1) 🎨 inline GitHub annotations ✅ JSON output + configurable 💪 published in TS with zero deps

github.comGitHub - danielroe/provenance-action: GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn).GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn). - danielroe/provenance-action

No replies yet.