fix: restore FailproofAI org casing in package.json URLs#372
Conversation
npm provenance verification compares package.json repository/homepage/bugs
URLs byte-for-byte against the ${{ github.repository }} value GitHub stamps
into the sigstore attestation. The org rename in #370 lowercased these to
"failproofai/failproofai", which broke publish for 0.0.11-beta.1 with
"422 Error verifying sigstore provenance bundle: Failed to validate
repository information".
GitHub URL routing is case-insensitive, so this only affected provenance
verification, not link resolution.
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
📝 WalkthroughWalkthroughThis PR corrects the GitHub organization name casing in package metadata URLs from ChangesGitHub Organization URL Casing Fix
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@CHANGELOG.md`:
- Line 13: Update the CHANGELOG.md entry that begins "Restore `FailproofAI` org
casing in `package.json` `homepage`, `repository.url`, and `bugs.url`..." to
append the PR reference in the required format (e.g., add " (`#372`)" or the
actual PR number) at the end of the single-line bullet; ensure the line remains
one sentence followed by the PR number in parentheses to match the project's
changelog style.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: 7f241980-fb8c-4cb7-9247-c9f33e082f76
📒 Files selected for processing (2)
CHANGELOG.mdpackage.json
Addresses coderabbit review on #372. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Summary
0.0.11-beta.1publish with422 Error verifying sigstore provenance bundle: Failed to validate repository information: package.json: "repository.url" is "git+https://github.com/failproofai/failproofai.git", expected to match "https://github.com/FailproofAI/failproofai" from provenancepackage.jsontofailproofai/failproofai. GitHub's${{ github.repository }}preserves the real casing (FailproofAI/failproofai) when stamping the sigstore attestation; npm compares the field byte-for-byte during publish-time verificationFailproofAIorg inhomepage,repository.url, andbugs.url. GitHub URL routing is case-insensitive, so this is purely a provenance-verification fix — link resolution was never affectedWhy only
package.jsonOther repo files still reference the lowercase
failproofai/failproofai(README badges,docs/docs.json,scripts/launch.ts,bin/failproofai.mjs). Those don't go through sigstore, so they're cosmetic and stay as-is for now. If/when we want full consistency we can do a follow-up sweep.Test plan
bun run test:run— 73 files, 1623 tests, all passbun run lint— clean (1 pre-existing<img>warning unrelated to this change)bunx tsc --noEmit— cleanv0.0.11-beta.1GitHub release pointing at the new HEAD →publish.ymlruns end-to-end (publish + alias publish + version bump)🤖 Generated with Claude Code
Summary by CodeRabbit