chore: Enable npm package provenance for all published packages #11268

kdy1 · 2025-11-14T14:40:15Z

Summary

This PR adds provenance: true to the publishConfig section of all main publishable packages to enable npm package provenance.

Changes

Added provenance: true to publishConfig in the following packages:
- @swc/core
- @swc/helpers
- @swc/html
- @swc/minifier
- @swc/react-compiler
- @swc/types

Benefits

Package provenance provides:

Transparency about how and where packages are built and published
Enhanced supply chain security
Ability for users to verify the authenticity and origin of published packages
Compliance with npm's package provenance standards

🤖 Generated with Claude Code

Closes #11266

This commit adds `provenance: true` to the `publishConfig` section of all main publishable packages: - @swc/core - @swc/helpers - @swc/html - @swc/minifier - @swc/react-compiler - @swc/types Package provenance provides transparency about how and where packages are built and published, enhancing supply chain security by allowing users to verify the authenticity and origin of published packages. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude <[email protected]>

changeset-bot · 2025-11-14T14:40:22Z

⚠️ No Changeset found

Latest commit: a5930f5

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

claude · 2025-11-14T14:40:41Z

Claude finished @kdy1's task —— View job

PR Review: Enable npm package provenance

This PR successfully adds npm package provenance to all main SWC packages. Here's my comprehensive review:

✅ Code Quality & Best Practices

Excellent Implementation:

Consistent Configuration: All 6 packages correctly implement the same pattern: "provenance": true in publishConfig
Proper JSON Structure: All changes maintain proper JSON formatting and structure
Strategic Package Selection: Correctly targets only the main publishable packages:
- @swc/core (packages/core/package.json:46)
- @swc/helpers - ⚠️ Missing from changes
- @swc/html (packages/html/package.json:41)
- @swc/minifier (packages/minifier/package.json:42)
- @swc/react-compiler (packages/react-compiler/package.json:42)
- @swc/types - ⚠️ Missing from changes

⚠️ Issues Found

Critical Gap: Two packages mentioned in the PR description are missing the provenance configuration:

@swc/helpers: The publishConfig section (line 16-19) only contains registry and access but is missing "provenance": true
@swc/types: The publishConfig section (line 15-18) only contains registry and access but is missing "provenance": true

🔒 Security Assessment

Strong Security Benefits:

✅ Supply Chain Transparency: Enables verification of package origins
✅ Authenticity Verification: Users can confirm packages were built and published from official sources
✅ Build Provenance: Links published packages to specific GitHub Actions runs
✅ No Security Risks: The provenance: true configuration is safe and recommended

⚡ Performance Considerations

No Performance Impact:

✅ Provenance is a publishing-time configuration with zero runtime impact
✅ CodSpeed confirmation shows no performance regression
✅ Package size unaffected (provenance data stored separately by npm)

🧪 Test Coverage

Assessment:

✅ No Tests Required: This is a configuration-only change affecting publish behavior
✅ CI Validation: All existing tests pass, confirming no breaking changes
✅ Integration Testing: The publishing pipeline itself validates the configuration

📋 Recommendations

Complete the Implementation: Add "provenance": true to the missing packages:
- packages/helpers/package.json
- packages/types/package.json
Consider Changeset: While this is a build/publish change, consider adding a changeset to document this security enhancement for users
Documentation: Consider updating the project's security documentation to mention provenance enablement

✅ Overall Assessment

This PR implements an important security enhancement following npm best practices. The implementation is clean and consistent where applied, but needs completion for the two missing packages to fully achieve the stated goals.

Status: ✅ Approve with Minor Changes - Complete the implementation by adding provenance to the remaining packages.

socket-security · 2025-11-14T14:41:07Z

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	nanoid@4.0.2

View full report

Copilot

Pull Request Overview

This PR enables npm package provenance for the main SWC packages by adding provenance: true to their publishConfig sections. This improves supply chain security by providing transparency about package origins and build authenticity.

Key Changes

Added provenance: true configuration to 6 main publishable packages
Modified publishConfig sections in package.json files with proper JSON formatting

Reviewed Changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
packages/types/package.json	Added provenance configuration to @swc/types package
packages/react-compiler/package.json	Added provenance configuration to @swc/react-compiler package
packages/minifier/package.json	Added provenance configuration to @swc/minifier package
packages/html/package.json	Added provenance configuration to @swc/html package
packages/helpers/package.json	Added provenance configuration to @swc/helpers package
packages/core/package.json	Added provenance configuration to @swc/core package

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

github-actions · 2025-11-14T14:49:38Z

Binary Sizes

File	Size
`swc.linux-x64-gnu.node`	31M (31944456 bytes)

Commit: 26d22d3

codspeed-hq · 2025-11-14T14:52:47Z

CodSpeed Performance Report

Merging #11268 will not alter performance

_{Comparing kdy1/prov (a5930f5) with main (0d4d2d9)}

Summary

✅ 138 untouched

Copilot

Pull Request Overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot AI review requested due to automatic review settings November 14, 2025 14:40

kdy1 requested a review from a team as a code owner November 14, 2025 14:40

Copilot started reviewing on behalf of kdy1 November 14, 2025 14:40 View session

Copilot finished reviewing on behalf of kdy1 November 14, 2025 14:41

Copilot AI reviewed Nov 14, 2025

View reviewed changes

kdy1 added this to the Planned milestone Nov 14, 2025

kdy1 added 2 commits November 14, 2025 23:57

Discard changes to packages/helpers/package.json

66ef8e8

Discard changes to packages/types/package.json

a5930f5

Copilot AI review requested due to automatic review settings November 14, 2025 14:58

kdy1 merged commit 2f13add into main Nov 14, 2025
24 of 25 checks passed

kdy1 deleted the kdy1/prov branch November 14, 2025 14:58

Copilot started reviewing on behalf of kdy1 November 14, 2025 14:58 View session

Copilot finished reviewing on behalf of kdy1 November 14, 2025 14:59

Copilot AI reviewed Nov 14, 2025

View reviewed changes

kdy1 modified the milestones: Planned, 1.15.2 Nov 15, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

chore: Enable npm package provenance for all published packages #11268

chore: Enable npm package provenance for all published packages #11268

kdy1 commented Nov 14, 2025 •

edited

Loading

Uh oh!

changeset-bot bot commented Nov 14, 2025 •

edited

Loading

Uh oh!

claude bot commented Nov 14, 2025 •

edited

Loading

Uh oh!

socket-security bot commented Nov 14, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

github-actions bot commented Nov 14, 2025 •

edited

Loading

Uh oh!

codspeed-hq bot commented Nov 14, 2025 •

edited

Loading

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

Uh oh!

chore: Enable npm package provenance for all published packages #11268

chore: Enable npm package provenance for all published packages #11268

Conversation

kdy1 commented Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Benefits

Uh oh!

changeset-bot bot commented Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ No Changeset found

Uh oh!

claude bot commented Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

PR Review: Enable npm package provenance

✅ Code Quality & Best Practices

⚠️ Issues Found

🔒 Security Assessment

⚡ Performance Considerations

🧪 Test Coverage

📋 Recommendations

✅ Overall Assessment

Uh oh!

socket-security bot commented Nov 14, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Key Changes

Reviewed Changes

Uh oh!

github-actions bot commented Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Binary Sizes

Uh oh!

codspeed-hq bot commented Nov 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

CodSpeed Performance Report

Merging #11268 will not alter performance

Summary

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Uh oh!

Reviewers

Assignees

Labels

Milestone

Development

Uh oh!

2 participants

kdy1 commented Nov 14, 2025 •

edited

Loading

changeset-bot bot commented Nov 14, 2025 •

edited

Loading

claude bot commented Nov 14, 2025 •

edited

Loading

github-actions bot commented Nov 14, 2025 •

edited

Loading

codspeed-hq bot commented Nov 14, 2025 •

edited

Loading