daniel r(ooooooh) at jsconf mx 🇲🇽 on Mythryl: “it also fails CI when downgrading from trusted publishing to…”

trusted publishing is fantastic for ensuring that the state of a @github.com repo maps to a public package ... but maintainers are still vulnerable to phishing, allowing bypassing it so: this action fails ci when upgrading to a 'non-provenanced' package

daniel r(ooooooh) at jsconf mx 🇲🇽@danielroe.dev

in light of the current supply chain attacks, I've just published a @github.com action to detect packages that _lose_ their provenance. 📦 supports pnpm-lock.yaml, package-lock.json, yarn.lock (v1) 🎨 inline GitHub annotations ✅ JSON output + configurable 💪 published in TS with zero deps

github.comGitHub - danielroe/provenance-action: GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn).GitHub Action that detects dependency provenance downgrades from lockfile changes (npm/pnpm/yarn). - danielroe/provenance-action

Post