chore: publish package provenance info (#959)

* chore: publish package provenance info

* fix: move provenance setting from package.json to release action env

* fix: remove changeset, not needed

---------

Co-authored-by: dominikg <[email protected]>

Author: benmccann

.github/workflows/release.yml

@@ -10,6 +10,7 @@ jobs:
   release:
     permissions:
       contents: write # to create release (changesets/action)
+      id-token: write # OpenID Connect token needed for provenance
       pull-requests: write # to create pull request (changesets/action)
     # prevents this action from running on forks
     if: github.repository == 'sveltejs/vite-plugin-svelte'
@@ -62,6 +63,7 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+          NPM_CONFIG_PROVENANCE: true
 
       # TODO alert discord
       # - name: Send a Slack notification if a publish happens