build(pkg): set repository.url to https://github.com/vercel/ai - #14793
Merged
Conversation
This should fix this npm publish error: > Error verifying sigstore provenance bundle: Failed to validate repository information: package.json: "repository.url" is "", expected to match "https://github.com/vercel/ai" from provenance
gr2m
enabled auto-merge (squash)
April 28, 2026 20:32
aayush-kapoor
approved these changes
Apr 28, 2026
This was referenced Apr 28, 2026
Merged
Merged
gr2m
added a commit
that referenced
this pull request
Apr 28, 2026
Backports the recent main-branch fixes that re-enabled releases after the GitHub App was retired and provenance was configured. ## Backported PRs - #14784 — `ci(release): use \`secrets.GITHUB_TOKEN\`` - #14785 — `ci(release): git config for GITHUB_TOKEN` - #14787 — `ci(release): sign commits by changesets/acion` - #14791 — `ci(release): use Node 24` - #14793 — `build(pkg): set \`repository.url\` to https://github.com/vercel/ai` - #14794 — `normalize package json files` - #14795 — `fix: trigger releases after provenance setup` - #14798 — `remove github app use in workflows` ## Notes on differences from main - v6 lacks the `@ai-sdk/otel` and `@ai-sdk/workflow` packages — both were excluded from the changeset and the package.json normalization sweep. - `release.yml` on v6 does not have the snapshot-release path that exists on main, so only the relevant subset of #14784/#14785/#14787/#14791 was applied. `NPM_TOKEN: secrets.NPM_TOKEN_ELEVATED` was kept in v6 since OIDC trusted publishing has not been configured for v6 packages. - `auto-merge-release-prs.yml` keeps the existing `GR2M_PR_REVIEW_TOKEN` (still needed for PR approval); only the `Bot` user-type check from #14798 was applied.
gr2m
added a commit
that referenced
this pull request
Apr 28, 2026
Backports the recent main-branch fixes that re-enabled releases after the GitHub App was retired and provenance was configured. ## Backported PRs - #14784 — `ci(release): use \`secrets.GITHUB_TOKEN\`` - #14785 — `ci(release): git config for GITHUB_TOKEN` - #14787 — `ci(release): sign commits by changesets/acion` - #14791 — `ci(release): use Node 24` - #14793 — `build(pkg): set \`repository.url\` to https://github.com/vercel/ai` - #14794 — `normalize package json files` - #14795 — `fix: trigger releases after provenance setup` - #14798 — `remove github app use in workflows` (the auto-merge bot-type check + `id-token: write` follow-up) ## Notes on differences from main / v6 - v5 lacks the `@ai-sdk/bytedance`, `@ai-sdk/devtools`, `@ai-sdk/klingai`, `@ai-sdk/open-responses`, `@ai-sdk/otel`, `@ai-sdk/voyage`, and `@ai-sdk/workflow` packages — all excluded from the changeset and the package.json sweep. - v5 has no `backport.yml` or `update-model-settings.yml` workflows, so the corresponding parts of #14798 do not apply. - v5's `release.yml` is simpler than main's (no snapshot path, no notify-released-PRs step), so only the relevant subset of #14784/#14785/#14787/#14791 was applied. `NPM_TOKEN: secrets.NPM_TOKEN_ELEVATED` was kept since OIDC trusted publishing has not been configured for v5 packages. - `auto-merge-release-prs.yml` keeps the existing `GR2M_PR_REVIEW_TOKEN` (still needed for PR approval); only the `Bot` user-type check from #14798 was applied. - `permissions` block added to `release.yml` with `id-token: write`, matching the v6 backport.
gr2m
added a commit
that referenced
this pull request
Jun 5, 2026
) This should fix this npm publish error: > Error verifying sigstore provenance bundle: Failed to validate repository information: package.json: "repository.url" is "", expected to match "https://github.com/vercel/ai" from provenance
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This should fix this npm publish error: