Supply-chain-hardened release tool for JS/TS libraries. Multi-runner reproducible-build attestation, OIDC trusted publishing, hard pre-publish gates. Pure bash, zero dependencies.
bash npm provenance release release-automation oidc reproducible-builds npm-publish github-actions slsa secret-scanning supply-chain-security composite-action reusable-workflow trusted-publishing action-pinning hardened-release
-
Updated
Apr 23, 2026 - Shell