From ed3d3c96b9b5f0a6b02b865f2f648fd9ff16888c Mon Sep 17 00:00:00 2001 From: Joseph Mearman Date: Sat, 12 Sep 2026 00:08:27 +0100 Subject: [PATCH] fix(release): declare package.json's repository field for provenance npm publish rejected the first release that reached this far with a 422: "Error verifying sigstore provenance bundle: Failed to validate repository information: package.json: 'repository.url' is '', expected to match 'https://github.com/ExaDev/wire-mesh' from provenance." Signed provenance (publishConfig.provenance, already set) verifies the published package's repository claim against GitHub's own OIDC-issued attestation, and package.json had no repository field at all for it to check against. Setting repository.directory to this package's actual subdirectory follows npm's own documented convention for a monorepo package that doesn't live at its repo's root. --- ts/packages/core/package.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/ts/packages/core/package.json b/ts/packages/core/package.json index 2850332..f68ad4f 100644 --- a/ts/packages/core/package.json +++ b/ts/packages/core/package.json @@ -3,6 +3,11 @@ "version": "0.0.0", "type": "module", "packageManager": "pnpm@10.33.0", + "repository": { + "type": "git", + "url": "https://github.com/ExaDev/wire-mesh.git", + "directory": "ts/packages/core" + }, "publishConfig": { "provenance": true, "access": "public"