Skip to content

fix(publish-fork): derive repository.url from current repo for provenance #16

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
dogmar merged 1 commit into from
May 29, 2026
+7 −5
Merged

fix(publish-fork): derive repository.url from current repo for provenance #16

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 7 additions & 5 deletions scripts/publish-fork.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -118,7 +118,7 @@ function main() {
// ── Step 3: Rewrite package.json files ────────────────────────────────
// Temporarily mutate each package.json for publishing. Changes:
// - "name" field: @tanstack/X → @klinking/X
// - "repository.url": TanStack/pacer → dogmar/pacer (for provenance attestation)
// - "repository.url": point at this fork's repo (for provenance attestation)
// - Internal deps: "workspace:*" → "npm:@klinking/X@<exact-version>"
// - Internal peer deps with semver: ">=0.16.4" → "npm:@klinking/X@>=0.16.4"
// External deps like @tanstack/store are NOT touched.
Expand All @@ -131,10 +131,12 @@ function main() {
console.log(`\n${originalName} -> ${pkg.name}`)

if (pkg.repository?.url) {
pkg.repository.url = pkg.repository.url.replace(
'TanStack/pacer',
'dogmar/pacer',
)
// npm --provenance signs an attestation from the GitHub OIDC token and
// the registry rejects the publish unless repository.url matches the repo
// that produced it. Derive the slug from the Actions context so this never
// drifts on a rename; fall back to the current fork slug for local runs.
const repoSlug = process.env.GITHUB_REPOSITORY ?? 'klink-ing/pacer'
pkg.repository.url = `git+https://github.com/${repoSlug}.git`
console.log(` repository.url -> ${pkg.repository.url}`)
}

Expand Down
Loading