⚙️ (jfrog): attest and sign tarball

.changeset/config.json

@@ -10,7 +10,7 @@
   "fixed": [],
   "linked": [],
   "access": "public",
-  "baseBranch": "feat/no-issue-jfrog-attest-sign-package",
+  "baseBranch": "develop",
   "updateInternalDependencies": "patch",
   "ignore": []
 }

.github/workflows/release.yml

@@ -1,14 +1,12 @@
 name: publish npm packages
 on:
-  pull_request:
-  # push:
-  #   branches:
-  #     - main
+  push:
+    branches:
+      - main
 
 env:
   FORCE_COLOR: "1"
-  # NPM_REGISTRY: jfrog.ledgerlabs.net/artifactory/api/npm/ldk-npm-prod-public
-  NPM_REGISTRY: jfrog.ledgerlabs.net/artifactory/api/npm/ldk-npm-sandbox-green
+  NPM_REGISTRY: jfrog.ledgerlabs.net/artifactory/api/npm/ldk-npm-prod-public
 
 permissions:
   id-token: write
@@ -19,7 +17,7 @@ permissions:
 
 jobs:
   publish:
-    # environment: Production
+    environment: Production
     runs-on: ledgerhq-shared-medium
     steps:
       - uses: actions/checkout@v4
@@ -50,11 +48,6 @@ jobs:
         uses: changesets/action@v1
         with:
           publish: pnpm release
-          # to remove
-          title: "⚙️ (release) [NO-ISSUE]: Version packages"
-          commit: "⚙️ (release): Version packages"
-          branch: feat/no-issue-jfrog-attest-sign-package
-          createGithubReleases: false
         env:
           GITHUB_TOKEN: ${{ secrets.CI_BOT_TOKEN }}
 
@@ -86,7 +79,7 @@ jobs:
 
       - name: Attest tarball
         if: steps.changesets.outputs.published == 'true'
-        uses: actions/attest-build-provenance@v1
+        uses: LedgerHQ/actions-security/actions/attest@actions/attest-1
         with:
           subject-path: ./dist