[RFC] npm provenance

How do you envision this feature/change to look/work like?

Each push to main should create a patch release if version bump is detected. The release should include an npm provenance and is created via the github action worklow.

What is the purpose of this change/feature? Why?

Link the code and the final bundle built between github <-> npm for integrity check.

(OPTIONAL) Example implementations

https://github.com/drizzle-team/drizzle-orm/pull/490/files#diff-2f1708aadc6da28cfdb6ae6eca96e32cabc80a0e2f4a82b95cf22d4579499676

(OPTIONAL) Contribution

• I would like to contribute to this RFC via a PR

Verify canary release

• I verified that the issue exists in plasmo canary release

Code of Conduct

• I agree to follow this project's Code of Conduct
• I checked the current issues for duplicate problems.