Fix npm provenance failure and bump version to 2.1.1 - #2
Merged
Conversation
npm publish --provenance validates that package.json repository.url matches the GitHub repo the build ran in. The URL pointed at the old mizius-studios/OpenBrowser slug while the build runs in miziusLabs/OpenBrowser, causing publish to fail with E422: Error verifying sigstore provenance bundle: Failed to validate repository information ... expected to match https://github.com/miziusLabs/OpenBrowser from provenance Point repository.url at the current repo and use the normalized git+https://...git form to also clear the npm pkg fix warning. Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
Trigger a fresh release now that the provenance repository.url is corrected. The Release workflow's sync:version step will propagate this to extensions/manifest.json and the README badge during publish. Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
pxlarified
added a commit
that referenced
this pull request
Jul 8, 2026
* Fix npm provenance failure by correcting repository URL npm publish --provenance validates that package.json repository.url matches the GitHub repo the build ran in. The URL pointed at the old mizius-studios/OpenBrowser slug while the build runs in miziusLabs/OpenBrowser, causing publish to fail with E422: Error verifying sigstore provenance bundle: Failed to validate repository information ... expected to match https://github.com/miziusLabs/OpenBrowser from provenance Point repository.url at the current repo and use the normalized git+https://...git form to also clear the npm pkg fix warning. Co-authored-by: fenjastical <fenjastical@users.noreply.github.com> * Bump version to 2.1.1 Trigger a fresh release now that the provenance repository.url is corrected. The Release workflow's sync:version step will propagate this to extensions/manifest.json and the README badge during publish. Co-authored-by: fenjastical <fenjastical@users.noreply.github.com> --------- Co-authored-by: fenjastical <fenjastical@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Release workflow's Publish to npm step failed with
E422(run 28901148005):npm publish --provenancerequirespackage.jsonrepository.urlto match the GitHub repository the build actually ran in. The value still pointed at the oldmizius-studios/OpenBrowserslug, while the workflow runs inmiziusLabs/OpenBrowser, so npm rejected the signed provenance bundle. Nothing was published (the request 422'd before upload).Changes
Correct
repository.urlto the current repo, using the normalizedgit+https://...gitform (also clears thenpm warn publish ... run "npm pkg fix"warning seen in the same log):Bump version
2.1.0->2.1.1so merging this triggers a fresh release.Release behavior
The Release workflow only publishes when its Detect version bump step sees a changed
package.jsonversion, and it checks outmain. On merge it will detect2.1.0 -> 2.1.1, runsync:versionto propagate the version intoextensions/manifest.jsonand the README badge, and publish2.1.1to npm with matching provenance.