[Feature]: Provenance Attestation (Security)

[elliot-huffman]

Area

React Components (@fluentui/react-components)

Describe the feature that you would like added

This allows you to publicly establish where a package was built and who published a package, which can increase supply-chain security for your packages.
Publishing this package using only GitHub actions and enable Provenance to enable the ability cryptographically to attest that the package hasn't been tampered with during build, publish, and transport.

When provenance support is enabled, attestations can be validated via npm audit signatures.

Additional context

Official Docs:
https://docs.npmjs.com/generating-provenance-statements

Extended discussion on the topic:
expressjs/discussions#268

Have you discussed this feature with our team

No response

Validations

• Check that there isn't already an issue that requests the same feature to avoid creating a duplicate.

Priority

Medium

[Hotell]

Thanks for filling this in ! We are aware about this and long term wanna move to GitHub for releases in order to get provenance but we are blocked by internal process atm.