Repository navigation
Tags: GSA/sam-styles
Tags
fix: restore repository field and bump to 3.1.1 to unblock npm publish ( #818) PR #817 was squash-merged before the provenance fix (9510da7) landed on the branch, so master shipped the version bump without it. v3.1.0 was tagged and released on GitHub, then failed at the registry: npm error 422 Unprocessable Entity Error verifying sigstore provenance bundle: Failed to validate repository information: package.json: "repository.url" is "", expected to match "https://github.com/GSA/sam-styles" from provenance npm latest is therefore still 3.0.25 and 3.1.0 does not exist on the registry. Since 3.1.0 is already tagged and Released on GitHub, reusing it would desync tag and artifact, so this ships the same content as 3.1.1. Root cause: package.json has had no "repository" field since the Storybook migration in 38d84ba (May 2022), which rewrote the scripts block and dropped the field added in b0459d2. It went unnoticed for three years because every release through 3.0.25 used a classic npm token, and token-based publishes do not generate a provenance bundle. OIDC Trusted Publishing sets --provenance implicitly. npm derives the source repo from the Actions OIDC claim, then requires package.json to agree; an absent repository field normalizes to "" and fails the match. Adds repository (git+https form, matching the provenance URL), plus homepage and bugs for registry completeness. No source, dependency, or public-surface change: 89 files, ~587 kB unpacked, same as 3.1.0. Co-authored-by: Frank Pigeon Jr. <4629398+fpigeonjr@users.noreply.github.com>
chore: bump 3.0.26 -> 3.1.0 as publish go-live pilot (#817) Supersedes the staged-but-unpublished 3.0.26 (#816) with a minor bump. Neither version ever reached npm (latest published is 3.0.25), so 3.1.0 satisfies the go-live pilot's "must be unpublished" requirement equally well while more honestly reflecting the scope of change since 3.0.25: Storybook 8.6 -> 10 on the Vite builder, a Playwright regression suite at 90% story coverage, WCAG 2.1 AA and SAST/DAST CI gates, and the tag-gated OIDC publish pipeline itself. No SCSS source changes. npm pack --dry-run: @gsa-sam/sam-styles@3.1.0, 89 files, ~586 kB unpacked -- same public surface as 3.0.25/3.0.26. Also backfills CHANGELOG.md, which had no entry since v0.0.21, and rewords a publish.yml comment that called 3.0.25 "current". Co-authored-by: Frank Pigeon Jr. <4629398+fpigeonjr@users.noreply.github.com>
PreviousNext