Add provenance to publishConfig in package.json (#98)

* Add provenance to publishConfig in package.json

* Create sharp-worms-divide.md

* Add id-token permission to CD, what used to publish to npm with provenance statements

.changeset/sharp-worms-divide.md

@@ -0,0 +1,5 @@
+---
+"web-csv-toolbox": patch
+---
+
+Add provenance to publishConfig in package.json

.github/workflows/cd.yaml

@@ -58,6 +58,7 @@ jobs:
     permissions:
       contents: write # Used to commit to "Version Packages" PR
       pull-requests: write # Used to create "Version Packages" PR
+      id-token: write # Used to publish to npm with provenance statements
       # Other permissions are defaulted to none
     steps:
       - name: Checkout Repo
@@ -92,6 +93,7 @@ jobs:
     runs-on: ubuntu-latest
     permissions:
       contents: read
+      id-token: write
     needs: release
     if: needs.release.outputs.published == 'false'
     steps:

package.json

@@ -82,6 +82,9 @@
   "bugs": {
     "url": "https://github.com/kamiazya/web-csv-toolbox/issues"
   },
+  "publishConfig": {
+    "provenance": true
+  },
   "homepage": "https://kamiazya.github.io/web-csv-toolbox/",
   "devDependencies": {
     "@biomejs/biome": "1.5.3",
@@ -105,4 +108,4 @@
     "vitest": "^1.2.2",
     "webdriverio": "^8.29.1"
   }
-}
+}