Maintenance: update lerna and implement npm provenance

[dreamorosi]

Summary

A couple of weeks ago GitHub announced a new feature called npm provenance.

npm packages built on a cloud CI/CD system (like GitHub Actions) can now publish with provenance, meaning the package has verifiable links back to its source code and build instructions.

At the time lerna, the package we use to publish our utilities to npm didn't support the feature, but version 6.6.2, which has just been released does.

We should go ahead and:

• update lerna to 6.6.2 or newer
• modify the workflow that makes the release to use this new feature

Why is this needed?

This way our customers can publicly establish where the Powertools for TypeScript package was built and who published, which can increase overall supply-chain confidence.

Which area does this relate to?

Governance

Solution

No response

Acknowledgment

• This request meets Lambda Powertools Tenets
• Should this be considered in other Lambda Powertools languages? i.e. Python, Java, and .NET

Future readers

Please react with 👍 and your use case to help us understand customer demand.

[github-actions]

⚠️ COMMENT VISIBILITY WARNING ⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

[github-actions]

This is now released under version 1.10.0!