From 4a4c3d4fb8b23762bd4d158d791f99721951531f Mon Sep 17 00:00:00 2001 From: indexzero Date: Tue, 30 Jun 2026 15:26:22 -0400 Subject: [PATCH] build: add repository metadata required for npm provenance The 2.0.0 publish has failed on every run since #11. The workflow itself was already correct for OIDC trusted publishing (id-token: write, registry-url, no token, pnpm pinned to 10.x). The two missing pieces were external to it: - The Trusted Publisher was never configured on npmjs.com (now done: indexzero/vlurp, release.yml). - package.json had no `repository` field, which npm provenance and the Trusted Publisher matcher both require. Add it (plus bugs/homepage). With both in place, merging to main runs `pnpm changeset publish`, which sees package.json at 2.0.0 (npm latest is 1.2.0) and publishes it with provenance and a v2.0.0 tag. Co-Authored-By: Claude Opus 4.8 (1M context) --- package.json | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/package.json b/package.json index 764946c..6cb4d7a 100644 --- a/package.json +++ b/package.json @@ -24,6 +24,14 @@ ], "author": "Charlie Robbins ", "license": "Apache-2.0", + "repository": { + "type": "git", + "url": "git+https://github.com/indexzero/vlurp.git" + }, + "bugs": { + "url": "https://github.com/indexzero/vlurp/issues" + }, + "homepage": "https://github.com/indexzero/vlurp#readme", "engines": { "node": ">=18.0.0" },