Repository navigation
Ensure Github Provenance from pipelines to npm #212
Description
Howdy!
Thanks for the great action. I would like to request that you ensure the npm publish pipeline is fully compliant with Github Provenance API.
https://github.blog/security/supply-chain-security/introducing-npm-package-provenance/
Example: https://www.npmjs.com/package/nestjs-otel (Scroll down to provenance)
Ledger entry example: https://search.sigstore.dev/?logIndex=249778415
Activity
marcellodesales commentedon Dec 11, 2025
Hey @pragmaticivan ... I was first curious about this, but isn't this action just responsible for pinning the workflow files? It doesn't touch on any other business logic...
I believe you are looking for a broader scope of a solution for workflows related to a programming language ecosystem, like NPM... IF you have resolved this otherway, please let me know 👍
Obrigado!
pragmaticivan commentedon Dec 11, 2025
@marcellodesales according to the readme, it's a traditional npm package https://www.npmjs.com/package/pin-github-action
I just wanted to make sure that there's some sort of provenance ensuring the package version release in npm can be fully tied back to a github actions workflow to ensure people are not releasing this package manually from any random place.