ci(dependencies): audited signatures and provenance attestations of installed packages

2023-04-21 16:41:27 -05:00
parent 278d8e6bec
commit ef998acd4d
2 changed files with 3 additions and 1 deletions
@@ -23,7 +23,8 @@ jobs:
        with:
          cache: npm
          node-version: lts/*
-      - run: npm ci
+      - run: npm clean-install
+      - run: npm audit signatures
      - run: npx semantic-release
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
@@ -36,6 +36,7 @@ jobs:
          node-version: ${{ matrix.node-version }}
          cache: npm
      - run: npm clean-install
+      - run: npm audit signatures
      - name: Ensure dependencies are compatible with the version of node
        run: npx ls-engines
      - run: npm run test:ci