Publish provenance for public packages #2664
Conversation
🦋 Changeset detectedLatest commit: 08d5911 The changes in this PR will be included in the next version bump. This PR includes changesets to release 4 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
github-actions
bot
added
🚨 action
✅ Deploy Preview for astro-starlight ready!
To edit notification comments on pull requests, go to your Netlify site configuration. |
| permissions: | ||
| contents: read | ||
| id-token: write |
There was a problem hiding this comment.
Hmm, looks like this still isn’t the right permissions combo in our case. The workflow failed after merging: https://github.com/withastro/starlight/actions/runs/12316634406/job/34377330918
Might need write access to create the release PR? Not sure why though — workflow looks the same as the Astro permission fix PR.
There was a problem hiding this comment.
Ah there was withastro/astro#8752 which updated to contents: write. Not much additional context in there though 😁
* main: Fix release workflow permissions (withastro#2665) Publish provenance for public packages (withastro#2664)
Description
While working in a workflow that involves strict security requirements, I noticed that Starlight public packages do not include any provenance. This PR fixes that by adding a
publishConfigblock to public packages.