🐛 fix(release): point package.json repository URLs at evmts/tevm - #2091
Conversation
npm provenance verification rejects every publish with E422: "repository.url" is "git+https://github.com/evmts/tevm-monorepo.git", expected to match "https://github.com/evmts/tevm" from provenance The repo was renamed evmts/tevm-monorepo -> evmts/tevm. GitHub redirects the URL, so nothing appeared broken, but the OIDC provenance statement carries the CURRENT repository name and npm compares it against package.json. Every one of the 85 package.json files still declared the old URL, so signing succeeded and verification then failed. Updates all 85 package.json repository URLs. Publishing is blocked until this lands.
|
The latest updates on your projects. Learn more about Vercel for GitHub.
1 Skipped Deployment
|
|
|
Claude encountered an error —— View job I'll analyze this and get back to you. |
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (85)
📝 WalkthroughWalkthroughThe pull request updates ChangesRepository metadata
Estimated code review effort: 1 (Trivial) | ~3 minutes ✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Warning There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure. 🔧 ESLint
ESLint install failed: dependency version conflict. Check your lock file or package.json. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
The failure
Every package fails to publish with
E422:Cause
The repo was renamed
evmts/tevm-monorepo→evmts/tevm. GitHub redirects the old URL, so nothing looked broken — but the OIDC provenance statement carries the current repository name, and npm validates it againstrepository.urlin package.json. All 85 package.json files still declared the old name, so the package signed successfully and then failed verification at the registry.This is the same class of rename fallout as the four release workflows that were gated on
github.repository == 'evmts/tevm-monorepo'(fixed in #2083).Change
All 85
package.jsonrepository URLs updated. JSON validity verified across every file.Publishing is blocked until this merges.
🤖 Generated with Smithers multi-agent orchestration
Summary by CodeRabbit