fix: correct package.json repository URLs for provenance (havenhq → midrender)#391
Merged
Conversation
The repo moved from havenhq/revideo to midrender/revideo, but package manifests still referenced the old org. npm provenance (emitted by the new OIDC trusted-publishing flow) validates that repository.url matches the repository the build ran in, so canary publishing failed with: E422 Error verifying sigstore provenance bundle: repository.url is "git+https://github.com/havenhq/revideo.git", expected to match "https://github.com/midrender/revideo" Updates all repository/bugs URLs to midrender, and adds a repository field to cli, ffmpeg, renderer, and player-react which had none.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The first OIDC canary release (run 29057736194) failed at the publish step. Trusted publishing worked (OIDC token + provenance were generated), but npm rejected the provenance because the package manifests still point at the old org:
npm provenance requires
repository.urlto match the repo the build actually ran in (midrender/revideo).What
repository.urlandbugsURLs fromhavenhq/revideo→midrender/revideo.repositoryfield tocli,ffmpeg,renderer, andplayer-react, which had none (would also block provenance).All 11 publishable packages now resolve to
https://github.com/midrender/revideo.git.After merge
Re-run Publish Packages to NPM (releaseType
canary) — the publish step should now pass provenance verification.