From a3d02a51e11523fc4548c3eb9aff0adbeec3fcd4 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Thu, 28 May 2026 23:48:54 +0000
Subject: [PATCH] fix(publish-fork): derive repository.url from current repo
 for provenance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The script rewrote repository.url to a hardcoded dogmar/pacer, left over
from before the repo moved to the klink-ing org. npm --provenance signs an
attestation from the GitHub OIDC token, and the registry rejects the
publish (E422) unless repository.url matches the repo that produced it —
so every package failed with dogmar/pacer != klink-ing/pacer.

Derive the slug from GITHUB_REPOSITORY (the Actions context) so it tracks
the real repo and won't drift on a future rename, falling back to the fork
slug for local runs.
---
 scripts/publish-fork.mjs | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/scripts/publish-fork.mjs b/scripts/publish-fork.mjs
index f4502c967..eee486775 100644
--- a/scripts/publish-fork.mjs
+++ b/scripts/publish-fork.mjs
@@ -118,7 +118,7 @@ function main() {
   // ── Step 3: Rewrite package.json files ────────────────────────────────
   // Temporarily mutate each package.json for publishing. Changes:
   //   - "name" field: @tanstack/X → @klinking/X
-  //   - "repository.url": TanStack/pacer → dogmar/pacer (for provenance attestation)
+  //   - "repository.url": point at this fork's repo (for provenance attestation)
   //   - Internal deps: "workspace:*" → "npm:@klinking/X@<exact-version>"
   //   - Internal peer deps with semver: ">=0.16.4" → "npm:@klinking/X@>=0.16.4"
   // External deps like @tanstack/store are NOT touched.
@@ -131,10 +131,12 @@ function main() {
     console.log(`\n${originalName} -> ${pkg.name}`)
 
     if (pkg.repository?.url) {
-      pkg.repository.url = pkg.repository.url.replace(
-        'TanStack/pacer',
-        'dogmar/pacer',
-      )
+      // npm --provenance signs an attestation from the GitHub OIDC token and
+      // the registry rejects the publish unless repository.url matches the repo
+      // that produced it. Derive the slug from the Actions context so this never
+      // drifts on a rename; fall back to the current fork slug for local runs.
+      const repoSlug = process.env.GITHUB_REPOSITORY ?? 'klink-ing/pacer'
+      pkg.repository.url = `git+https://github.com/${repoSlug}.git`
       console.log(`  repository.url -> ${pkg.repository.url}`)
     }