Starting today, when you build your npm projects on GitHub Actions, you can publish provenance alongside your package by including the flag. This provenance data gives consumers a verifiable way to link a package back to its source repository and the specific build instructions used to publish it (see example on npmjs.com).

Read full article on Github