On: Obtainium: Get Android App Updates Directly from t...

[porridgeraisin]

NPM has support for github CI provenance. So you can verify that the package on npm was built on the github actions of the repo mentioned in npm.

[g-b-r → porridgeraisin]

I saw, nice

It seems to not check it automatically, though?

[porridgeraisin → g-b-r]

Yeah, you have to set provenance flag to true.

  - uses: JS-DevTools/npm-publish@v2
  with:
      token: ${{ secrets.NPM_TOKEN }}
      access: public
      provenance: true

For example