From 8273f524dac3d3857f889d0c0b732523db5c9da8 Mon Sep 17 00:00:00 2001 From: Setu Shah Date: Fri, 13 Nov 2026 16:20:30 -0800 Subject: [PATCH] fix: set repository field on published packages for npm provenance Trusted publishing generates a provenance attestation, and the registry rejects the publish (E422) unless package.json repository.url matches the GitHub repo that built it. None of the public packages declare one, so inject it at publish time alongside the scope rewrite. --- scripts/publish.mjs | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/scripts/publish.mjs b/scripts/publish.mjs index 77351597..cf01d5fe 100644 --- a/scripts/publish.mjs +++ b/scripts/publish.mjs @@ -29,11 +29,12 @@ import { statSync, existsSync, } from 'node:fs'; -import { join } from 'node:path'; +import { join, relative } from 'node:path'; const ROOT = new URL('..', import.meta.url).pathname; const INTERNAL_SCOPE = '@agentscript/'; const PUBLISH_SCOPE = '@sf-agentscript/'; +const REPOSITORY_URL = 'git+https://github.com/salesforce/agentscript.git'; // File extensions whose contents may contain bare module specifiers we need to // rewrite. Sourcemaps (.map) embed `sources`/`names` strings as plain JSON, so @@ -95,6 +96,20 @@ for (const pkg of packages) { } } +// npm provenance rejects a publish (E422) unless repository.url matches the +// GitHub repo that built it. +for (const pkg of packages) { + const pkgJsonPath = join(pkg.path, 'package.json'); + const pkgJson = JSON.parse(readFileSync(pkgJsonPath, 'utf8')); + if (pkgJson.private) continue; + pkgJson.repository = { + type: 'git', + url: REPOSITORY_URL, + directory: relative(ROOT, pkg.path), + }; + writeFileSync(pkgJsonPath, JSON.stringify(pkgJson, null, 2) + '\n'); +} + // Step 3: Rewrite source-text files inside each package's published dirs. // tsc emits source import specifiers verbatim into dist/, and most packages // also ship src/, so consumers will see @agentscript/* unless we patch both.