feat: npm provenance + publish-token health actions - #3

Merged

asafgolombek merged 9 commits into

mainfrom

dev/asafgolombek/supply-chain-actions

Jul 19, 2026

Commits on Jul 19, 2026

feat: npm provenance classifier with real-capture fixtures
asafgolombek
committed
0b53d49
fix(ci): use an explicit glob for the test runner

asafgolombek
and
claude
committed
c6106ee
test: assert detail content, not just its length

asafgolombek
and
claude
committed
26ed4ca
feat: attestation fetch with deterministic backoff
asafgolombek
committed
ea42d3f
test: assert retry exhaustion in 5xx and network-error paths
asafgolombek
committed
d46e941
feat: verify-npm-provenance composite action
asafgolombek
committed
0b0ecea
fix(verify-npm-provenance): use process.exitCode instead of process.exit()
asafgolombek
committed
9971acf
feat: probe-publish-token action via vendor verify-pat
asafgolombek
committed
6dbd82b
fix(probe-publish-token): add not-configured status for unset secret
asafgolombek
committed
d60ab38