Skip to content

fix: configure npm provenance for 0.2.2 - #11

Merged
Bre77 merged 2 commits into
mainfrom
fm/tsfa-publish-oidc-fix
Aug 1, 2026
Merged

fix: configure npm provenance for 0.2.2#11
Bre77 merged 2 commits into
mainfrom
fm/tsfa-publish-oidc-fix

Conversation

@Bre77

@Bre77 Bre77 commented Aug 1, 2026

Copy link
Copy Markdown
Member

Intent

The v0.2.1 npm publish workflow now clears auth (npm trusted publishing/OIDC is configured) but fails during provenance verification with E422: package.json's repository.url is empty, but sigstore provenance requires it to match https://github.com/Teslemetry/node-tesla-fleet-api. Fix: add a repository field to package.json pointing at this exact repo (matching the shape used by other Teslemetry npm packages, e.g. projects/typescript-teslemetry/packages/api/package.json). Also bump the version to 0.2.2 rather than reusing 0.2.1, since neither prior publish attempt for 0.2.1 actually succeeded (both failed before the registry accepted anything) - 0.2.2 satisfies existing ^0.2.1 consumers. Do not touch the publish workflow itself or any other files; this is intentionally a minimal 2-line package.json change. A brief AGENTS.md/CLAUDE.md note was also added documenting the provenance repository.url requirement for future publish troubleshooting.

What Changed

  • Add the package repository metadata required for npm provenance verification.
  • Bump the package version from 0.2.1 to 0.2.2.
  • Document the repository URL requirement for future release troubleshooting.

Risk Assessment

✅ Low: The change is narrowly scoped and correctly adds the exact repository URL required for provenance, bumps the package to 0.2.2, leaves the publish workflow untouched, and documents the release constraint.

Testing

Inspected the complete commit scope, confirmed the publish workflow was untouched, then produced and inspected the consumer npm tarball; it exposes version 0.2.2 and the exact provenance-required repository URL, with no test artifacts left in the worktree.

Evidence: Packed npm metadata

{ "name": "tesla-fleet-api", "version": "0.2.2", "repository": { "type": "git", "url": "https://github.com/Teslemetry/node-tesla-fleet-api"
}
}

{
  "name": "tesla-fleet-api",
  "version": "0.2.2",
  "repository": {
    "type": "git",
    "url": "https://github.com/Teslemetry/node-tesla-fleet-api"
  }
}
Evidence: npm pack manifest
[
  {
    "id": "tesla-fleet-api@0.2.2",
    "name": "tesla-fleet-api",
    "version": "0.2.2",
    "size": 39338,
    "unpackedSize": 185994,
    "shasum": "79a8b64b89a491297079916c98d3d84b38dba9be",
    "integrity": "sha512-vtxrYmF+n6fTdx8QqFItFiZMnZPgEi7lZGJ6ilPtGv+6KGIuWKhTLEp2k65SWHfGM65XmbtMwTP7XIms6ZB+Rw==",
    "filename": "tesla-fleet-api-0.2.2.tgz",
    "files": [
      {
        "path": "README.md",
        "size": 322,
        "mode": 420
      },
      {
        "path": "package.json",
        "size": 891,
        "mode": 420
      },
      {
        "path": "src/charging.ts",
        "size": 2445,
        "mode": 420
      },
      {
        "path": "src/commands.ts",
        "size": 48993,
        "mode": 420
      },
      {
        "path": "src/energy.ts",
        "size": 8010,
        "mode": 420
      },
      {
        "path": "src/energyspecific.ts",
        "size": 5782,
        "mode": 420
      },
      {
        "path": "src/helpers.ts",
        "size": 337,
        "mode": 420
      },
      {
        "path": "src/index.ts",
        "size": 841,
        "mode": 420
      },
      {
        "path": "src/partner.ts",
        "size": 1353,
        "mode": 420
      },
      {
        "path": "src/signing/crypto.ts",
        "size": 1133,
        "mode": 420
      },
      {
        "path": "src/signing/errors.ts",
        "size": 1643,
        "mode": 420
      },
      {
        "path": "src/signing/session.ts",
        "size": 5355,
        "mode": 420
      },
      {
        "path": "src/tariff.ts",
        "size": 18617,
        "mode": 420
      },
      {
        "path": "src/teslafleetapi.ts",
        "size": 5103,
        "mode": 420
      },
      {
        "path": "src/teslemetry.ts",
        "size": 1390,
        "mode": 420
      },
      {
        "path": "src/tessie.ts",
        "size": 1447,
        "mode": 420
      },
      {
        "path": "src/types/commands.ts",
        "size": 1356,
        "mode": 420
      },
      {
        "path": "src/types/live_status.ts",
        "size": 712,
        "mode": 420
      },
      {
        "path": "src/types/products.ts",
        "size": 1554,
        "mode": 420
      },
      {
        "path": "src/types/responses.ts",
        "size": 90,
        "mode": 420
      },
      {
        "path": "src/types/site_info.ts",
        "size": 4320,
        "mode": 420
      },
      {
        "path": "src/types/vehicle_data.ts",
        "size": 8356,
        "mode": 420
      },
      {
        "path": "src/types/vehicle.ts",
        "size": 522,
        "mode": 420
      },
      {
        "path": "src/user.ts",
        "size": 1225,
        "mode": 420
      },
      {
        "path": "src/vehicle.ts",
        "size": 39028,
        "mode": 420
      },
      {
        "path": "src/vehiclesigned.ts",
        "size": 1150,
        "mode": 420
      },
      {
        "path": "src/vehiclespecific.ts",
        "size": 24019,
        "mode": 420
      }
    ],
    "entryCount": 27,
    "bundled": []
  }
]
- Evidence: Consumer npm package (local file: /tmp/no-mistakes-evidence/01KYY4X9Q6RGYHHT8GMP6C89MN/tesla-fleet-api-0.2.2.tgz)

Pipeline

Updates from git push no-mistakes

✅ **intent** - passed

✅ No issues found.

✅ **Rebase** - passed

✅ No issues found.

✅ **Review** - passed

✅ No issues found.

✅ **Test** - passed

✅ No issues found.

  • git diff --name-status 026df711f0c86cf3ab040b5f69ce9b58802d3142..41c179ea42fdd914a4fb7445301aac974dde8cae
  • git diff --unified=80 026df711f0c86cf3ab040b5f69ce9b58802d3142..41c179ea42fdd914a4fb7445301aac974dde8cae -- package.json AGENTS.md CLAUDE.md
  • npm pack --ignore-scripts --pack-destination /tmp/no-mistakes-evidence/01KYY4X9Q6RGYHHT8GMP6C89MN --json
  • Extracted package/package.json from the generated tarball and asserted package name tesla-fleet-api, version 0.2.2, repository type git, and exact URL https://github.com/Teslemetry/node-tesla-fleet-api
  • git status --short after packaging to verify no working-tree artifacts were created
✅ **Document** - passed

✅ No issues found.

✅ **Lint** - passed

✅ No issues found.

✅ **Push** - passed

✅ No issues found.

@Bre77
Bre77 merged commit a54ce9b into main Aug 1, 2026
1 check passed
@Bre77 Bre77 added the fm Opened by a Firstmate crewmate label Aug 1, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

fm Opened by a Firstmate crewmate

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant