Trusted Publishing Badge

[targetlucked69]

📋 Description

Add badge that states that a npm package is published using OpenID Connect - https://docs.npmjs.com/trusted-publishers

[PyvesB]

Hello @targetlucked69 👋🏻

What would be the use case for this? Which API would we be able to hit to get the OpenID Connect information?

[targetlucked69]

Hi! Hmm there is no direct one, but we can hit the npm API and check the _npmUser property. The _npmUser property will have a trustedPublisher property that confirms a package is published via OIDC.

Example: https://registry.npmjs.org/vue/latest

"_npmUser": {
  "name": "GitHub Actions",
  "email": "npm-oidc-no-reply@github.com",
  "trustedPublisher": {
    "id": "github", // can be github or gitlab
    "oidcConfigId": "oidc:d56cba3e-2e34-4b01-9442-d2f0981e3993"
  }
},