fix: declare repository field for npm trusted publishing#1159
Merged
ericcrosson-bitgo merged 1 commit intoJul 21, 2026
Conversation
npm trusted publishing signs a provenance statement asserting the package was built from BitGo/api-ts, and the registry rejects any tarball whose package.json repository.url does not match (E422). None of the workspace packages declared a repository field, so every publish under OIDC failed after upload. Ticket: AI-744 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
mehulgroverx32
approved these changes
Jul 21, 2026
ericcrosson-bitgo
deleted the
AI-744-ci-use-oidc-capable-npm-for-releases
branch
July 21, 2026 20:18
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Release run 29864210735 fails at
npm publishwith:OIDC trusted publishing itself works — the provenance statement is signed and uploaded — but the registry rejects the tarball because provenance validation requires
repository.urlin each publishedpackage.jsonto match the repo in the attestation, and no workspace package declared one.Fix
Declare
repository(withdirectory) in all six workspace manifests, matching the pattern used by BitGo/BitGoWASM where trusted publishing works.Also carries the AI-744 CI commits switching the release workflow to OIDC-capable npm.
Ticket: AI-744
🤖 Generated with Claude Code