tree c6a2f458ab20bfba7d226e7c8a4faf81a71a787c
parent b378e67a6c92538d67273a70e0a53db1de6172d2
author Marc Kupietz <kupietz@ids-mannheim.de> 1784800872 +0200
committer Marc Kupietz <kupietz@ids-mannheim.de> 1784800872 +0200

Add repository field for npm provenance verification

npm rejects provenance-signed publishes (E422) when package.json has no
repository.url matching the GitHub repo recorded in the sigstore
provenance statement.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Change-Id: Ie6cf80826b6bd36ea16b430acb7098e9d1138211