ci: generate npm provenance statements when publishing

[martinkuba]

Which problem is this PR solving?

npm has a feature to display provenance statements for published packages. This allows users to see and verify how the package in npm has been built and published. Documentation for the npm feature is here.

Short description of the changes

Since this repository is already using a Github Actions workflow to publish to npm, the only change is to add the id-token permission and configure npm to publish with provenance. There are three options documented here:

• NPM_CONFIG_PROVENANCE env variable
• publishConfig.provenance configuration in package.json
• flag in .npmrc file

I have chosen the environment variable. The package.json option would require updating all package.json files for packages that are published. The npmrc option seems less visible to me than having it directly in the workflow.

I have not tested this with this repository (due to the release-please process). However, I setup a separate repository for testing from which I was able to simulate publishing similar to how it works here. An example of a published package with the provenance statement can be seen here.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.42%. Comparing base (dfb2dff) to head (3d36440).
Report is 182 commits behind head on main.

❗ Current head 3d36440 differs from pull request most recent head 56ccea2

Please upload reports for the commit 56ccea2 to get more accurate results.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2308      +/-   ##
==========================================
- Coverage   90.97%   90.42%   -0.56%     
==========================================
  Files         146      148       +2     
  Lines        7492     7322     -170     
  Branches     1502     1518      +16     
==========================================
- Hits         6816     6621     -195     
- Misses        676      701      +25     

see 63 files with indirect coverage changes

[trentm]

Thanks.

[pichlermarc]

Looks good, thx 🙂