chore: maybe enable publishing provenance (#144)

Signed-off-by: Jan Kowalleck <[email protected]>
CycloneDX · Jun 26, 2024 · 97cfff2 · 97cfff2
1 parent 44715bd
commit 97cfff2
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 1 deletion.
diff --git a/package.json b/package.json
@@ -110,6 +110,9 @@
     "!/**"
   ],
   "publishConfig": {
+    "provenance": true
+  },
+  "publishReplace": {
     "$comment": "this section defines how `tools/make-dist-package.cjs` works",
     "private": false,
     "main": "./yarn-plugin-cyclonedx.cjs",

diff --git a/tools/write-dist-manifest.cjs b/tools/write-dist-manifest.cjs
@@ -39,7 +39,7 @@ const structuredClonePolyfill =
 function main (outputFile) {
   const manifestSource = JSON.parse(readFileSync(manifestSourceFile))
   const manifest = structuredClonePolyfill(manifestSource)
-  for (const [k, v] of Object.entries(manifestSource.publishConfig ?? {})) {
+  for (const [k, v] of Object.entries(manifestSource.publishReplace ?? {})) {
     if (k[0] === '$') {
       continue
     }
@@ -48,6 +48,7 @@ function main (outputFile) {
     }
     manifest[k] = v
   }
+  manifest.publishReplace = undefined
   // dist is expected to be a bundle - no deps need install
   manifest.dependencies = {}
   // move deps to devDeps - for documentation purposes