// the find
danielroe/provenance-action
Fail CI when dependencies in your lockfile lose npm provenance or trusted publisher status
A GitHub Action that diffs your lockfile against the base branch and fails CI if any dependency loses npm provenance, trusted publisher status, or staged publishing. Targets the supply chain attack vector where a maintainer account gets compromised and publishes a package through a non-trusted path. Useful for security-conscious teams shipping to production with strict dependency hygiene.
Handles all four major lockfile formats including transitive dependencies, not just direct ones — which is where most real attacks land. Inline annotations at the exact lockfile line make triage fast. The `fail-on-provenance-change` flag catches repo/branch drift in attestations, which is a subtler signal than an outright provenance loss. Test fixtures cover format edge cases and the provenance API response shapes, so the parsing logic is actually tested.
Pinned to `@main` in the quick-start example, which is a supply chain risk in a tool literally about supply chain security — should default to a pinned SHA or tag. Repository/branch change detection is self-described as best-effort with known gaps in attestation shape coverage. pnpm's native `trustPolicy` already obsoletes this for the dominant use case in the JS ecosystem, which the README buries in a note. Running TypeScript directly on Node 24 via the entrypoint means startup time is non-trivial for large lockfiles with many changed packages.