Fixed Koenig npm publish failing provenance repository verification - #29199
Conversation
ref https://github.com/TryGhost/Ghost/actions/runs/29023545026/job/86139566830 - the Koenig packages' package.json repository fields still pointed at the old TryGhost/Koenig repo, but since the monorepo merge they are published from TryGhost/Ghost with npm provenance enabled - npm verifies the sigstore provenance bundle against repository.url and rejected the publish with a 422 on the repo mismatch, breaking the publish_koenig_packages release job - updated every koenig/* package to point at TryGhost/Ghost with the package path in repository.directory, and fixed kg-simplemde's stale homepage/bugs URLs while there
|
Bugbot is not enabled for this team, so this pull request was not reviewed. Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs. |
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (13)
WalkthroughThis pull request updates package.json metadata across fourteen koenig packages, changing the repository field from a plain string URL to a structured object specifying type, url, and directory pointing to the TryGhost/Ghost monorepo. Additionally, koenig/kg-simplemde/package.json updates its homepage and bugs.url fields from legacy TryGhost/Koenig links to corresponding TryGhost/Ghost links. No exported or public entity declarations are affected. Suggested reviewers: 🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
| Command | Status | Duration | Result |
|---|---|---|---|
nx run @tryghost/admin-x-settings:test:acceptance |
✅ Succeeded | 11m 27s | View ↗ |
nx run-many --target=build --projects=tag:publi... |
✅ Succeeded | <1s | View ↗ |
nx run ghost:test:ci:integration |
✅ Succeeded | 2m 6s | View ↗ |
nx run-many -t test:unit -p @tryghost/kg-card-f... |
✅ Succeeded | 6m 45s | View ↗ |
nx run ghost:test:integration |
✅ Succeeded | 2m 57s | View ↗ |
nx run @tryghost/koenig-lexical:test:acceptance |
✅ Succeeded | 2m 38s | View ↗ |
nx run @tryghost/admin:build |
✅ Succeeded | 3m 13s | View ↗ |
nx run ghost:test:legacy |
✅ Succeeded | 3m 18s | View ↗ |
Additional runs (8) |
✅ Succeeded | ... | View ↗ |
💡 Verify your cache is correct by running tasks in a sandbox. Read docs ↗
☁️ Nx Cloud last updated this comment at 2026-07-09 14:43:40 UTC
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #29199 +/- ##
=======================================
Coverage 74.04% 74.04%
=======================================
Files 1570 1570
Lines 136621 136629 +8
Branches 16521 16521
=======================================
+ Hits 101162 101168 +6
- Misses 34425 34458 +33
+ Partials 1034 1003 -31
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
2 participants
ref https://github.com/TryGhost/Ghost/actions/runs/29023545026/job/86139566830
The
publish_koenig_packagesrelease job failed on the last release: npm rejected the very first package with a 422 because sigstore provenance verification compares each package'srepository.urlagainst the repository the workflow actually ran in. All thekoenig/*packages still declaredhttps://github.com/TryGhost/Koenig/...from before the monorepo merge, but the provenance bundle attests they were built fromTryGhost/Ghost, so every publish attempt is doomed until the fields match. No packages were published by the failed run.koenig/*package to the standard monorepo form:repository.urlpointing atTryGhost/Ghostwith the package path inrepository.directorykg-simplemde's stalehomepageandbugsURLs that also still pointed at the old repoVerified with
hosted-git-info(the library npm uses for this check) that the new URLs normalise toTryGhost/Ghostwhile the old ones normalise toTryGhost/Koenig— exactly the reported mismatch. The registry-side check can't be exercised by a dry run (npm skips provenance generation entirely with--dry-run), but the fix can be proven end-to-end by dispatching thepublish-koenig-package.ymlescape-hatch workflow for a single small package.