From https://docs.npmjs.com/generating-provenance-statements

    In order to publish a package with provenance, you must build your package with a supported cloud CI/CD provider. Today this includes GitHub Actions, and we are collaborating with additional providers to expand support.

I really hope that's not an empty statement. I enjoy some aspects of Github, but would hate to see it become the only trusted source for an entire language's ecosystem.