sigil

every release under signature.

fork it. push. your release ships with sigstore signatures, slsa v1.0 provenance, and npm trusted publisher. no NPM_TOKEN. no path to publish without provenance.

the chain

flowchart TB
src["1. source<br/>gitsign + signed-commit branch protection"]
deps["2. deps<br/>npm ci --ignore-scripts + lockfile + dependabot"]
bld["3. build<br/>harden-runner + SHA-pinned actions"]
pub["4. publish<br/>npm OIDC --provenance + cosign sign-blob"]
dst["5. distribute<br/>npm registry attestation"]
con["6. consume<br/>verify.sh: audit + cosign + slsa-verifier"]
src --> deps --> bld --> pub --> dst --> con
classDef src fill:#f05032,stroke:#000,color:#fff
classDef deps fill:#cb3837,stroke:#000,color:#fff
classDef bld fill:#fbca04,stroke:#000,color:#000
classDef pub fill:#2ea44f,stroke:#000,color:#fff
classDef dst fill:#7a52d6,stroke:#000,color:#fff
classDef con fill:#326ce5,stroke:#000,color:#fff
class src src
class deps deps
class bld bld
class pub pub
class dst dst
class con con

Loading

if any link breaks, the next step refuses the input. that is the only behaviour.

use this template

# 1. click "Use this template" on github# 2. clone your new repo
git clone https://github.com/<you>/<your-repo>.git
cd<your-repo># 3. rename + sha-pin every action
./scripts/init.sh <your-org><your-repo># 4. install + verify locally
npm ci
npm run check
# 5. configure npm trusted publisher on npmjs.com# settings -> packages -> add trusted publisher# repository: <your-org>/<your-repo># workflow: .github/workflows/release.yml# environment: release

init.sh prints the gh api one-liner to apply branch protection. run it.

verify a release (consumer side)

./scripts/verify.sh @<org>/<repo>@1.0.0

three independent proofs, three exit codes:

1. npm audit signatures — registry-served sigstore attestation
2. cosign verify-blob — workflow identity pinned via OIDC
3. slsa-verifier verify-npm-package — slsa v1.0 provenance

any one fails -> non-zero -> install rejected.

see also

• chainscope for the conceptual map
• docs/github-settings.md for the one-time UI hardening
• docs/branch-protection.md for the branch protection api call
• SECURITY.md for vulnerability reporting
• CONTRIBUTING.md for contributor rules
• MIT