Skip to content

fix(cli): add repository field so provenance validates on publish - #28

Merged
losolio merged 1 commit into
mainfrom
fix/provenance-repository
Jul 25, 2026
Merged

fix(cli): add repository field so provenance validates on publish#28
losolio merged 1 commit into
mainfrom
fix/provenance-repository

Conversation

@losolio

@losolio losolio commented Jul 25, 2026

Copy link
Copy Markdown
Contributor

The OIDC publish now authenticates (the trusted-publisher workflow filename was
corrected to release.yml), but 0.2.0 failed provenance validation:

422 - Error verifying sigstore provenance bundle: package.json "repository.url"
is "", expected to match "https://github.com/losol/lectio-docs" from provenance

lectio-docs (apps/site-builder) was missing a repository field. npm checks it
against the sigstore attestation GitHub Actions generates. Added it to match the
core packages.

No changeset: 0.2.0 is already the version on main (just not on npm). Merging
this triggers the release workflow, which republishes 0.2.0 — now with
provenance validating.

After merge

  • Release workflow runs → publishes lectio-docs@0.2.0 with provenance
  • Verify: npm view lectio-docs version → 0.2.0

lectio-docs was missing `repository`, so OIDC publishing failed provenance
validation — npm checks package.json repository.url against the sigstore
attestation from GitHub Actions. Matches the core packages' metadata.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Copilot AI review requested due to automatic review settings July 25, 2026 17:37
@losolio
losolio merged commit 90321b1 into main Jul 25, 2026
2 checks passed

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

This PR fixes npm provenance validation for the lectio-docs package published from apps/site-builder by adding a repository field to its package.json, aligning it with the existing monorepo packages’ metadata so the Sigstore/GitHub Actions provenance repository URL matches during publish.

Changes:

  • Add "repository" metadata (type, url, and directory) to apps/site-builder/package.json to satisfy npm provenance checks.
  • Align the apps/site-builder package’s repository metadata format with packages/lectio-docs and packages/lectio-docs-react.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants