chore(release): 0.4.0 - #26
Merged
Merged
Conversation
0.3.1 is already on npm, so the release path needs a bump before it can
publish anything. main now carries a breaking change — credentials yield
the authenticator's real public key, so the derived did:key differs from
0.3.x — which pre-1.0 makes this a minor bump.
Writes up the five merged PRs and folds in the entries that had
accumulated under Unreleased since 0.3.1.
Also hardens the publish step. setup-node with registry-url writes
`_authToken=${NODE_AUTH_TOKEN}` into .npmrc; with an empty value npm can
attempt token auth and fail rather than falling back to trusted
publishing. The publish job drops registry-url (registry.npmjs.org is
the default) and sets an auth token only when auth: token is chosen, so
the OIDC path leaves no empty credential behind. Worth getting right
before the first real release run rather than after it fails.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
NiKrause
added a commit
that referenced
this pull request
Jul 30, 2026
… — and then npm rejected the upload: (#30) ``` npm error code E422 npm error 422 Unprocessable Entity - PUT https://registry.npmjs.org/@le-space%2forbitdb-identity-provider-webauthn-did Error verifying sigstore provenance bundle: Failed to validate repository information: package.json: "repository.url" is "git+https://github.com/le-space/orbitdb-identity-provider-webauthn-did.git", expected to match "https://github.com/Le-Space/orbitdb-identity-provider-webauthn-did" from provenance ``` `package.json` carried `github.com/le-space/…`; the repository is `Le-Space`. The provenance attestation is built from the actual repository identity, and the comparison is case-sensitive, so the two never matched. This was latent for as long as the field has been wrong — it only surfaces now because nothing published with `--provenance` before. `repository.url`, `bugs.url` and `homepage` are all corrected. ## Progress on the release Each attempt has moved one step further: | Attempt | Reached | Failed on | |---|---|---| | 1 | verify | tag vs. `package.json` version (PR #26 was unmerged) | | 2 | publish | `ENEEDAUTH` — trusted publisher not registered for the package | | 3 | publish | my own probe, which guessed a non-existent endpoint | | 4 | publish | `ENEEDAUTH` again; verbose log identified the cause | | 5 | **upload** | provenance repository mismatch — this PR | Nothing has been published at any point, so `0.4.0` remains free. 🤖 Generated with [Claude Code](https://claude.com/claude-code) BODY fix: match the repository URL casing so provenance verifies The v0.4.0 run got past auth — the NPM_TOKEN fallback works — and npm then rejected the upload: npm error code E422 Error verifying sigstore provenance bundle: Failed to validate repository information: package.json: "repository.url" is "git+https://github.com/le-space/orbitdb-identity-provider-webauthn-did.git", expected to match "https://github.com/Le-Space/orbitdb-identity-provider-webauthn-did" from provenance package.json carried github.com/le-space/...; the repository is Le-Space. The provenance attestation is built from the actual repository identity and the comparison is case-sensitive, so the two never matched. Latent for as long as the field has been wrong — it surfaces only now because nothing had published with --provenance before. repository.url, bugs.url and homepage are all corrected. Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Prepares the first release through the CI publish path. Publishes nothing on its own — merging this only lands the version bump and changelog; publishing happens when a
v0.4.0tag is pushed.Why 0.4.0
package.jsonsays0.3.1, and0.3.1is already thelateston npm — so the release path cannot publish anything until the version moves.mainnow carries a breaking change: credentials yield the authenticator's real public key, so the deriveddid:keydiffers from 0.3.x. Existing identities keyed on the old DID will not match. Pre-1.0 that makes this a minor bump.Also in here: a fix to the publish step
actions/setup-nodewithregistry-urlwrites_authToken=${NODE_AUTH_TOKEN}into.npmrc. With an empty value npm can attempt token authentication and fail rather than falling back to trusted publishing — which, given theNPM_TOKENsecret is still invalid, is exactly the failure mode the first release run would have hit.The publish job now drops
registry-url(registry.npmjs.org is the default) and writes an auth token only whenauth: tokenis explicitly chosen, so the OIDC path leaves no empty credential behind.I would rather correct this before the first release attempt than diagnose it afterwards.
The remaining step is yours
Publishing to npm is irreversible — a version number can never be reused — so I have not tagged anything.
After merging:
That runs
verify(tag vs.package.json,npm pack), then the full suite, then publishes with provenance, then reports in the job summary.Two things worth knowing before you do:
npm publish; there is no read-only probe I can run beforehand. If the configuration is off, the run fails and nothing is published — recoverable, just re-tag after fixing.npm version 0.4.0—postversionisgit push && git push --tags, and the version is already bumped here, so it would try to go to 0.4.1.Tell me if you would rather I push the tag once this is merged.
🤖 Generated with Claude Code