fix(release): add provenance-safe repository metadata

Author: lightningRalf

README.md

@@ -245,6 +245,7 @@ Trusted-publishing learnings captured in this template:
 - release-please workflow uses `googleapis/release-please-action` v4.4.0 (SHA pinned) and no deprecated `command` input.
 - publish workflow and release-check workflow both upgrade npm (`>=11.5.1`) for consistent trusted publishing behavior.
 - release-check script tolerates npm `already published version` dry-run responses for post-release idempotency.
+- package metadata must include `repository.url` matching the GitHub repo for npm provenance verification.
 - for GitHub repos using this template, ensure Actions policy allows external actions and workflow permissions are `Read and write` with PR creation enabled.
 - first-time npm package bootstrap may still require one token-based publish before configuring npm trusted publisher on package settings.
 

copier-template/README.md.jinja

@@ -107,6 +107,7 @@ Trusted-publishing defaults captured in this scaffold:
 - release-please action is pinned to an immutable v4.4.0 SHA.
 - publish workflow and release-check workflow both upgrade npm (`>=11.5.1`) for consistent trusted publishing behavior.
 - release-check script tolerates npm `already published version` dry-run responses for post-release idempotency.
+- package metadata must include `repository.url` matching the GitHub repo for npm provenance verification.
 
 Recommended before release:
 

copier-template/docs/dev/trusted_publishing.md

@@ -43,6 +43,7 @@ then configure trusted publisher and continue with OIDC-only CI publishes.
 2. **release-please PR creation failure**: workflow permissions are read-only.
 3. **Tag mismatch**: release-please component tags differ from publish trigger expectation.
 4. **Publish setup failure**: npm cache expects lockfile that is not checked in.
+5. **Provenance verification failure (E422)**: `package.json` `repository.url` is missing or does not match the GitHub repository URL in provenance.
 
 ## Verification checklist
 

copier-template/package.json.jinja

@@ -4,6 +4,14 @@
   "description": "pi extension package for {{ command_name }} workflows in pi",
   "type": "module",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/{{ github_maintainer }}/{{ repo_name }}.git"
+  },
+  "bugs": {
+    "url": "https://github.com/{{ github_maintainer }}/{{ repo_name }}/issues"
+  },
+  "homepage": "https://github.com/{{ github_maintainer }}/{{ repo_name }}#readme",
   "keywords": [
     "pi-package",
     "pi-extension",

copier-template/scripts/release-check.sh

@@ -6,9 +6,15 @@ cd "$ROOT_DIR"
 
 NAME="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).name")"
 VERSION="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")"
+REPOSITORY_URL="$(node -p "(() => { const pkg = JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')); const repo = pkg.repository; if (typeof repo === 'string') return repo.trim(); if (repo && typeof repo === 'object' && typeof repo.url === 'string') return repo.url.trim(); return ''; })()")"
 
 echo "== release-check: ${NAME}@${VERSION}"
 
+if [[ -z "$REPOSITORY_URL" ]]; then
+  echo "package.json repository.url is required for provenance release publishing." >&2
+  exit 1
+fi
+
 if [[ "$NAME" != "${NAME,,}" ]]; then
   echo "Invalid npm package name: must be lowercase: $NAME" >&2
   exit 1

package.json

@@ -4,6 +4,14 @@
   "description": "Copier template + CLI for bootstrapping production-ready pi extension repositories",
   "type": "module",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tryingET/pi-extensions-template_copier.git"
+  },
+  "bugs": {
+    "url": "https://github.com/tryingET/pi-extensions-template_copier/issues"
+  },
+  "homepage": "https://github.com/tryingET/pi-extensions-template_copier#readme",
   "keywords": [
     "pi-package",
     "pi-extension",

scripts/release-check-template.sh

@@ -6,9 +6,15 @@ cd "$ROOT_DIR"
 
 NAME="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).name")"
 VERSION="$(node -p "JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')).version")"
+REPOSITORY_URL="$(node -p "(() => { const pkg = JSON.parse(require('node:fs').readFileSync('package.json', 'utf8')); const repo = pkg.repository; if (typeof repo === 'string') return repo.trim(); if (repo && typeof repo === 'object' && typeof repo.url === 'string') return repo.url.trim(); return ''; })()")"
 
 echo "== template release-check: ${NAME}@${VERSION}"
 
+if [[ -z "$REPOSITORY_URL" ]]; then
+  echo "package.json repository.url is required for provenance release publishing." >&2
+  exit 1
+fi
+
 if [[ "$NAME" != "${NAME,,}" ]]; then
   echo "Invalid npm package name: must be lowercase: $NAME" >&2
   exit 1