Publish to NPM using provenance statements (#261)

Signed-off-by: Juan Cruz Viotti <[email protected]>

Author: jviotti

.github/workflows/package.yml

@@ -13,6 +13,8 @@ concurrency:
 
 permissions:
   contents: write
+  # See https://docs.npmjs.com/generating-provenance-statements#about-npm-provenance
+  id-token: write
 
 jobs:
   package:

npm-deploy.sh

@@ -90,6 +90,7 @@ cat << EOF > "$OUTPUT/npm/staging/package.json"
     "url": "git+https://github.com/sourcemeta/jsonschema.git"
   },
   "publishConfig": {
+    "provenance": true,
     "access": "public"
   },
   "devDependencies": {