Include npm packages in binary provenance processing

Author: jbrejner

.github/workflows/release.yml

@@ -146,6 +146,9 @@ jobs:
           FURY_TOKEN: ${{ secrets.FURY_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
 
+      - name: Copy npm packages into dist for provenance
+        run: find npm -name "*.tgz" -exec cp {} dist/ \;
+
       - uses: actions/upload-artifact@v7
         with:
           name: dist
@@ -155,7 +158,7 @@ jobs:
       - name: Prepare artifacts list
         id: prepare-artifacts-list
         run: |
-          ARTIFACTS=$(jq '[reduce .[] as $item (
+          GORELEASER_ARTIFACTS=$(jq '[reduce .[] as $item (
             [];
             if ($item.type == "Archive") then
                 . + [{ template_name: ($item.goos + "-" + $item.goarch), path: $item.path }]
@@ -166,6 +169,18 @@ jobs:
             end
            )][]' dist/artifacts.json)
 
+          NPM_ARTIFACTS=$(find dist -maxdepth 1 -name "*.tgz" -printf '%f\n' \
+            | jq -R '{
+                template_name: ("npm-" + sub("-[0-9]+\\.[0-9]+\\.[0-9]+.*\\.tgz$"; "")),
+                path: ("dist/" + .)
+              }' \
+            | jq -s '.')
+
+          ARTIFACTS=$(jq -n \
+            --argjson g "$GORELEASER_ARTIFACTS" \
+            --argjson n "$NPM_ARTIFACTS" \
+            '$g + $n')
+
           echo "artifacts<<nEOFn" >> $GITHUB_OUTPUT
           echo "${ARTIFACTS}" >> $GITHUB_OUTPUT
           echo "nEOFn" >> $GITHUB_OUTPUT