Set up provenance

https://docs.npmjs.com/generating-provenance-statements
This may not work properly because of the dynamic versioning of the package.json file.

But I try it anyway.

.github/workflows/release.yml

@@ -13,6 +13,10 @@ jobs:
 
     continue-on-error: true
 
+    permissions:
+      contents: read
+      id-token: write
+
     steps:
       - uses: actions/checkout@v4
 
@@ -33,6 +37,9 @@ jobs:
 
       - name: set git tag version
         run: |
+          # https://docs.npmjs.com/generating-provenance-statements
+          # This may not work properly. dynamic versioning may cause a problem.
+          export NPM_CONFIG_PROVENANCE=true
           git config user.email "dummy@dummy"
           git config user.name "dummy"
           pnpm version from-git --allow-same-version --no-git-tag-version -ws || true