feat(ci): added npm package provenance attestation (#3016)

.github/workflows/release.yml

@@ -38,6 +38,8 @@ jobs:
     if: github.repository == 'lucide-icons/lucide'
     runs-on: ubuntu-latest
     needs: pre-release
+    permissions:
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -80,11 +82,15 @@ jobs:
 
       - name: Publish
         run: pnpm --filter ${{ matrix.package }} publish --access public --no-git-checks --ignore-scripts
+        env:
+          NPM_CONFIG_PROVENANCE: true
 
   lucide-static:
     if: github.repository == 'lucide-icons/lucide'
     runs-on: ubuntu-latest
     needs: [pre-release, lucide-font]
+    permissions:
+      id-token: write
     steps:
       - uses: actions/checkout@v4
       - uses: actions/download-artifact@v4
@@ -111,6 +117,8 @@ jobs:
 
       - name: Publish
         run: pnpm --filter lucide-static publish --no-git-checks
+        env:
+          NPM_CONFIG_PROVENANCE: true
 
   lucide-font:
     if: github.repository == 'lucide-icons/lucide'