Skip to content

Fix npm provenance failure and bump version to 2.1.1 - #2

Merged
pxlarified merged 2 commits into
mainfrom
fix/npm-provenance-repository-url
Jul 7, 2026
Merged

Fix npm provenance failure and bump version to 2.1.1#2
pxlarified merged 2 commits into
mainfrom
fix/npm-provenance-repository-url

Conversation

@pxlarified

@pxlarified pxlarified commented Jul 7, 2026

Copy link
Copy Markdown
Member

Why

The Release workflow's Publish to npm step failed with E422 (run 28901148005):

npm error 422 Unprocessable Entity - PUT https://registry.npmjs.org/@pxlarified%2fbrowser
Error verifying sigstore provenance bundle: Failed to validate repository information:
package.json: "repository.url" is "git+https://github.com/mizius-studios/OpenBrowser.git",
expected to match "https://github.com/miziusLabs/OpenBrowser" from provenance

npm publish --provenance requires package.json repository.url to match the GitHub repository the build actually ran in. The value still pointed at the old mizius-studios/OpenBrowser slug, while the workflow runs in miziusLabs/OpenBrowser, so npm rejected the signed provenance bundle. Nothing was published (the request 422'd before upload).

Changes

  1. Correct repository.url to the current repo, using the normalized git+https://...git form (also clears the npm warn publish ... run "npm pkg fix" warning seen in the same log):

    "repository": {
      "type": "git",
      "url": "git+https://github.com/miziusLabs/OpenBrowser.git"
    }
  2. Bump version 2.1.0 -> 2.1.1 so merging this triggers a fresh release.

Release behavior

The Release workflow only publishes when its Detect version bump step sees a changed package.json version, and it checks out main. On merge it will detect 2.1.0 -> 2.1.1, run sync:version to propagate the version into extensions/manifest.json and the README badge, and publish 2.1.1 to npm with matching provenance.

pxlarified and others added 2 commits July 7, 2026 22:06
npm publish --provenance validates that package.json repository.url
matches the GitHub repo the build ran in. The URL pointed at the old
mizius-studios/OpenBrowser slug while the build runs in
miziusLabs/OpenBrowser, causing publish to fail with E422:

  Error verifying sigstore provenance bundle: Failed to validate
  repository information ... expected to match
  https://github.com/miziusLabs/OpenBrowser from provenance

Point repository.url at the current repo and use the normalized
git+https://...git form to also clear the npm pkg fix warning.

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
Trigger a fresh release now that the provenance repository.url is
corrected. The Release workflow's sync:version step will propagate this
to extensions/manifest.json and the README badge during publish.

Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
@pxlarified pxlarified changed the title Fix npm provenance failure by correcting repository URL Fix npm provenance failure and bump version to 2.1.1 Jul 7, 2026
@pxlarified
pxlarified merged commit 98448b5 into main Jul 7, 2026
5 checks passed
@pxlarified
pxlarified deleted the fix/npm-provenance-repository-url branch July 7, 2026 22:08
pxlarified added a commit that referenced this pull request Jul 8, 2026
* Fix npm provenance failure by correcting repository URL

npm publish --provenance validates that package.json repository.url
matches the GitHub repo the build ran in. The URL pointed at the old
mizius-studios/OpenBrowser slug while the build runs in
miziusLabs/OpenBrowser, causing publish to fail with E422:

  Error verifying sigstore provenance bundle: Failed to validate
  repository information ... expected to match
  https://github.com/miziusLabs/OpenBrowser from provenance

Point repository.url at the current repo and use the normalized
git+https://...git form to also clear the npm pkg fix warning.

Co-authored-by: fenjastical <fenjastical@users.noreply.github.com>

* Bump version to 2.1.1

Trigger a fresh release now that the provenance repository.url is
corrected. The Release workflow's sync:version step will propagate this
to extensions/manifest.json and the README badge during publish.

Co-authored-by: fenjastical <fenjastical@users.noreply.github.com>

---------

Co-authored-by: fenjastical <fenjastical@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant