Skip to content

fix: restore FailproofAI org casing in package.json URLs#372

Merged
NiveditJain merged 1 commit into
mainfrom
luv-374
May 20, 2026
Merged

fix: restore FailproofAI org casing in package.json URLs#372
NiveditJain merged 1 commit into
mainfrom
luv-374

Conversation

@NiveditJain
Copy link
Copy Markdown
Member

@NiveditJain NiveditJain commented May 20, 2026

Summary

  • npm rejected the 0.0.11-beta.1 publish with 422 Error verifying sigstore provenance bundle: Failed to validate repository information: package.json: "repository.url" is "git+https://github.com/failproofai/failproofai.git", expected to match "https://github.com/FailproofAI/failproofai" from provenance
  • Root cause: Rename exospherehost → failproofai across repo (URLs, X handle, policy namespace) #370 (org rename) lowercased the three URL fields in package.json to failproofai/failproofai. GitHub's ${{ github.repository }} preserves the real casing (FailproofAI/failproofai) when stamping the sigstore attestation; npm compares the field byte-for-byte during publish-time verification
  • Fix: restore the camelcase FailproofAI org in homepage, repository.url, and bugs.url. GitHub URL routing is case-insensitive, so this is purely a provenance-verification fix — link resolution was never affected

Why only package.json

Other repo files still reference the lowercase failproofai/failproofai (README badges, docs/docs.json, scripts/launch.ts, bin/failproofai.mjs). Those don't go through sigstore, so they're cosmetic and stay as-is for now. If/when we want full consistency we can do a follow-up sweep.

Test plan

  • bun run test:run — 73 files, 1623 tests, all pass
  • bun run lint — clean (1 pre-existing <img> warning unrelated to this change)
  • bunx tsc --noEmit — clean
  • Merge → recreate v0.0.11-beta.1 GitHub release pointing at the new HEAD → publish.yml runs end-to-end (publish + alias publish + version bump)

🤖 Generated with Claude Code

Summary by CodeRabbit

  • Bug Fixes
    • Corrected GitHub organization URLs in package metadata to ensure proper casing and npm provenance verification.

Review Change Stack

npm provenance verification compares package.json repository/homepage/bugs
URLs byte-for-byte against the ${{ github.repository }} value GitHub stamps
into the sigstore attestation. The org rename in #370 lowercased these to
"failproofai/failproofai", which broke publish for 0.0.11-beta.1 with
"422 Error verifying sigstore provenance bundle: Failed to validate
repository information".

GitHub URL routing is case-insensitive, so this only affected provenance
verification, not link resolution.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
@coderabbitai
Copy link
Copy Markdown

coderabbitai Bot commented May 20, 2026

📝 Walkthrough

Walkthrough

This PR corrects the GitHub organization name casing in package metadata URLs from failproofai to FailproofAI, addressing an npm Sigstore provenance verification failure that was rejecting the publish with a 422 validation error. The fix is applied to three fields (homepage, repository.url, bugs.url) and documented in the changelog.

Changes

GitHub Organization URL Casing Fix

Layer / File(s) Summary
GitHub org URL casing correction
package.json, CHANGELOG.md
package.json homepage, repository.url, and bugs.url are corrected to use FailproofAI organization casing, and CHANGELOG.md documents the fix in 0.0.11-beta.1 release notes.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Poem

A rabbit hops through GitHub's hall,
With capitals restored to all—
FailproofAI shines bright and true,
No more provenance "4-2-2" blues! 🐰✨

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely summarizes the main change: restoring FailproofAI org casing in package.json URLs to fix a provenance verification failure.
Description check ✅ Passed The description includes a clear summary, root cause analysis, fix explanation, and comprehensive test results, covering all essential details despite not following the exact template structure.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.


Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CHANGELOG.md`:
- Line 13: Update the CHANGELOG.md entry that begins "Restore `FailproofAI` org
casing in `package.json` `homepage`, `repository.url`, and `bugs.url`..." to
append the PR reference in the required format (e.g., add " (`#372`)" or the
actual PR number) at the end of the single-line bullet; ensure the line remains
one sentence followed by the PR number in parentheses to match the project's
changelog style.
🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

  • Push a commit to this branch (recommended)
  • Create a new PR with the fixes

ℹ️ Review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 7f241980-fb8c-4cb7-9247-c9f33e082f76

📥 Commits

Reviewing files that changed from the base of the PR and between 48ec1ce and 78f06c0.

📒 Files selected for processing (2)
  • CHANGELOG.md
  • package.json

Comment thread CHANGELOG.md
@NiveditJain NiveditJain merged commit ac948e4 into main May 20, 2026
8 checks passed
NiveditJain added a commit that referenced this pull request May 20, 2026
Addresses coderabbit review on #372.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant