3 people 2b0b4b587e ci(release): publish npm packages with provenance and attest release bundles (#1296) ...

Every published artifact is now cryptographically verifiable as built by
this repo's Release workflow: npm publishes carry npm provenance (OIDC,
shows the Provenance badge on npmjs.com), and the GitHub Release bundles
+ SHA256SUMS get signed build attestations via
actions/attest-build-provenance, verifiable with
`gh attestation verify <file> -R colbymchenry/codegraph`.

pack-npm.sh now writes a repository field into the generated shim and
per-platform package.jsons — npm --provenance refuses to publish without
one matching the repo — and the root package.json gains the same field.

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-07-15 19:10:34 -05:00

..

workflows

ci(release): publish npm packages with provenance and attest release bundles (#1296)

2026-07-15 19:10:34 -05:00