Skip to content

fix: add repository field for npm provenance#24

Merged
amondnet merged 1 commit into
mainfrom
fix/provenance-repository
Jun 2, 2026
Merged

fix: add repository field for npm provenance#24
amondnet merged 1 commit into
mainfrom
fix/provenance-repository

Conversation

@amondnet
Copy link
Copy Markdown
Contributor

@amondnet amondnet commented Jun 2, 2026

문제

publish_only 디스패치 발행이 provenance 검증에서 실패했습니다 (run). OIDC 인증·provenance 서명까지는 성공했지만:

npm error code E422
npm error 422 Unprocessable Entity - PUT https://registry.npmjs.org/@pleaseai%2feslint-config
Error verifying sigstore provenance bundle: Failed to validate repository information:
package.json: "repository.url" is "", expected to match "https://github.com/pleaseai/code-style" from provenance

npm publish --provenance는 package.json의 repository.url이 빌드 repo와 일치해야 합니다. @pleaseai/eslint-config@pleaseai/prettier-configrepository 필드가 아예 없어서 거부됐습니다. (cli는 이미 보유 → 첫 스텝 실패로 뒤 패키지는 skip됨.)

변경

두 패키지 package.json에 repository 필드 추가 (cli와 동일 패턴, directory 포함):

"repository": {
  "type": "git",
  "url": "https://github.com/pleaseai/code-style.git",
  "directory": "packages/eslint-config"  // 또는 packages/perttier-config
}

머지 후

gh workflow run release-please.yml -f publish_only=true --repo pleaseai/code-style

→ eslint 0.0.4 / code-style 0.0.3 / prettier 0.0.1이 provenance와 함께 발행됩니다.

npm publish --provenance rejects packages whose package.json lacks a
repository.url matching the building repo (E422: "repository.url" is
"", expected to match https://github.com/pleaseai/code-style). The
eslint-config and prettier-config packages had no repository field, so
the publish_only run failed at provenance verification. Add it to both
(cli already had one).
@cloudflare-workers-and-pages
Copy link
Copy Markdown

Deploying code-style with  Cloudflare Pages  Cloudflare Pages

Latest commit: 0447f42
Status:⚡️  Build in progress...

View logs

Copy link
Copy Markdown

@gemini-code-assist gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request adds repository metadata to the package.json files for both the ESLint and Prettier configuration packages. A review comment highlights a typo in the directory name ('perttier-config' instead of 'prettier-config') within the Prettier package configuration, which should be addressed to maintain consistency.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

"repository": {
"type": "git",
"url": "https://github.com/pleaseai/code-style.git",
"directory": "packages/perttier-config"
Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

디렉터리 이름에 오타(perttier-config -> prettier-config)가 있습니다. 패키지 이름은 @pleaseai/prettier-config로 올바르게 설정되어 있으나, 실제 디렉터리 경로명에 오타가 존재하여 일관성이 떨어집니다.\n\n현재 실제 디렉터리명이 perttier-config로 되어 있어 npm provenance 검증을 통과하려면 이 값을 유지해야 할 수 있습니다. 하지만 혼선을 방지하기 위해 추후 디렉터리 이름을 prettier-config로 변경하고 이 필드도 함께 수정하는 리팩토링을 진행하는 것을 권장합니다.

@amondnet amondnet merged commit 3ec62e2 into main Jun 2, 2026
1 of 2 checks passed
@amondnet amondnet deleted the fix/provenance-repository branch June 2, 2026 01:42
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant