From e5498d764da66e81fe35a0e24ac0c72eceafdc74 Mon Sep 17 00:00:00 2001
From: Big Boss <bigboss@metalrodeo.xyz>
Date: Fri, 21 Aug 2026 12:46:57 -0500
Subject: [PATCH] fix(release): give the platform packages a repository field
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The v0.3.1 publish failed with:

  422 Unprocessable Entity - Error verifying sigstore provenance bundle:
  package.json: "repository.url" is "", expected to match
  "https://github.com/alleneubank/linear-cli" from provenance

OIDC auth itself worked — this is the next gate along. Trusted
publishing turns on provenance automatically for public repos, and npm
refuses an upload whose package.json does not name the repo the
provenance attests to. Only the wrapper package had a repository field;
the four platform packages had none.

check-versions.sh now checks repository.url on every npm manifest.
Everything else about v0.3.1 was green — tag, gate, GitHub release, all
8 assets — and it still could not publish, which is precisely the shape
of failure a pre-publish gate exists to catch. Observed red against a
deleted repository field before wiring it in.

Bumps to 0.3.2; v0.3.1 reached GitHub but not npm.
---
 .claude-plugin/plugin.json               |  2 +-
 CHANGELOG.md                             | 11 +++++++++++
 npm/linear-cli-darwin-arm64/package.json |  8 +++++++-
 npm/linear-cli-darwin-x64/package.json   |  8 +++++++-
 npm/linear-cli-linux-arm64/package.json  |  8 +++++++-
 npm/linear-cli-linux-x64/package.json    |  8 +++++++-
 npm/linear-cli/package.json              | 10 +++++-----
 package.json                             |  2 +-
 scripts/check-versions.sh                | 18 ++++++++++++++++++
 9 files changed, 64 insertions(+), 11 deletions(-)

diff --git a/.claude-plugin/plugin.json b/.claude-plugin/plugin.json
index dd059d6..dc48d90 100644
--- a/.claude-plugin/plugin.json
+++ b/.claude-plugin/plugin.json
@@ -1,6 +1,6 @@
 {
   "name": "linear-cli",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Linear CLI integration for Claude Code - manage issues, teams, and projects",
   "author": {
     "name": "0xbigboss"
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 3e627f9..3d5d733 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -3,6 +3,17 @@
 Notable changes per release. Versions before 0.3.0 are recorded in the
 [GitHub releases](https://github.com/alleneubank/linear-cli/releases).
 
+## 0.3.2
+
+### Fixed
+
+- The four npm platform packages had no `repository` field. Trusted publishing
+  generates sigstore provenance automatically, and npm rejects the upload with
+  a 422 when `repository.url` does not match the repo the provenance came from,
+  so the v0.3.1 publish failed after the tag and GitHub release had already
+  gone green. `scripts/check-versions.sh` now checks `repository.url` on every
+  npm manifest, which fails the release before it publishes anything.
+
 ## 0.3.1
 
 The first release published through trusted publishing. Content is identical to
diff --git a/npm/linear-cli-darwin-arm64/package.json b/npm/linear-cli-darwin-arm64/package.json
index c69216f..1eca3cb 100644
--- a/npm/linear-cli-darwin-arm64/package.json
+++ b/npm/linear-cli-darwin-arm64/package.json
@@ -1,6 +1,12 @@
 {
   "name": "@0xbigboss/linear-cli-darwin-arm64",
-  "version": "0.3.1",
+  "version": "0.3.2",
+  "description": "Linear CLI binary for darwin-arm64",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alleneubank/linear-cli.git"
+  },
+  "license": "MIT",
   "os": [
     "darwin"
   ],
diff --git a/npm/linear-cli-darwin-x64/package.json b/npm/linear-cli-darwin-x64/package.json
index 3d6a160..d476819 100644
--- a/npm/linear-cli-darwin-x64/package.json
+++ b/npm/linear-cli-darwin-x64/package.json
@@ -1,6 +1,12 @@
 {
   "name": "@0xbigboss/linear-cli-darwin-x64",
-  "version": "0.3.1",
+  "version": "0.3.2",
+  "description": "Linear CLI binary for darwin-x64",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alleneubank/linear-cli.git"
+  },
+  "license": "MIT",
   "os": [
     "darwin"
   ],
diff --git a/npm/linear-cli-linux-arm64/package.json b/npm/linear-cli-linux-arm64/package.json
index 7b9b1be..8314ca2 100644
--- a/npm/linear-cli-linux-arm64/package.json
+++ b/npm/linear-cli-linux-arm64/package.json
@@ -1,6 +1,12 @@
 {
   "name": "@0xbigboss/linear-cli-linux-arm64",
-  "version": "0.3.1",
+  "version": "0.3.2",
+  "description": "Linear CLI binary for linux-arm64",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alleneubank/linear-cli.git"
+  },
+  "license": "MIT",
   "os": [
     "linux"
   ],
diff --git a/npm/linear-cli-linux-x64/package.json b/npm/linear-cli-linux-x64/package.json
index fcc6f18..ea1e12f 100644
--- a/npm/linear-cli-linux-x64/package.json
+++ b/npm/linear-cli-linux-x64/package.json
@@ -1,6 +1,12 @@
 {
   "name": "@0xbigboss/linear-cli-linux-x64",
-  "version": "0.3.1",
+  "version": "0.3.2",
+  "description": "Linear CLI binary for linux-x64",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alleneubank/linear-cli.git"
+  },
+  "license": "MIT",
   "os": [
     "linux"
   ],
diff --git a/npm/linear-cli/package.json b/npm/linear-cli/package.json
index 4a3289e..6ab7450 100644
--- a/npm/linear-cli/package.json
+++ b/npm/linear-cli/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@0xbigboss/linear-cli",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Linear CLI built with Zig",
   "license": "MIT",
   "repository": {
@@ -11,9 +11,9 @@
     "linear": "bin.js"
   },
   "optionalDependencies": {
-    "@0xbigboss/linear-cli-darwin-arm64": "0.3.1",
-    "@0xbigboss/linear-cli-darwin-x64": "0.3.1",
-    "@0xbigboss/linear-cli-linux-x64": "0.3.1",
-    "@0xbigboss/linear-cli-linux-arm64": "0.3.1"
+    "@0xbigboss/linear-cli-darwin-arm64": "0.3.2",
+    "@0xbigboss/linear-cli-darwin-x64": "0.3.2",
+    "@0xbigboss/linear-cli-linux-x64": "0.3.2",
+    "@0xbigboss/linear-cli-linux-arm64": "0.3.2"
   }
 }
diff --git a/package.json b/package.json
index cc64862..13904c3 100644
--- a/package.json
+++ b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "linear-cli",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Pi package for @0xbigboss/linear-cli: Linear issue/team/project management via the linear CLI. Exposes the linear skill.",
   "license": "MIT",
   "keywords": [
diff --git a/scripts/check-versions.sh b/scripts/check-versions.sh
index 9de5194..79d1f03 100755
--- a/scripts/check-versions.sh
+++ b/scripts/check-versions.sh
@@ -12,6 +12,13 @@
 #   .claude-plugin/plugin.json    Claude Code plugin
 #   npm/*/package.json            npm dist packages
 #   npm/linear-cli optionalDependencies pins
+#   npm/*/package.json repository.url
+#
+# The repository check is here because trusted publishing generates sigstore
+# provenance, and npm rejects the upload when package.json's repository.url
+# does not match the repo the provenance came from. The four platform packages
+# had no repository field at all, which failed the v0.3.1 publish with a 422
+# AFTER the tag, the GitHub release, and every other gate had gone green.
 #
 # Usage: check-versions.sh [--expect <version>]
 #   --expect pins every manifest to that version (CI passes the tag).
@@ -60,6 +67,17 @@ while IFS= read -r pin; do
     fi
 done < <(jq -r '.optionalDependencies // {} | to_entries[] | "\(.key)=\(.value)"' npm/linear-cli/package.json)
 
+# Provenance: npm compares this against the OIDC claim and 422s on a mismatch.
+expected_repo="git+https://github.com/alleneubank/linear-cli.git"
+for f in npm/*/package.json; do
+    url="$(jq -r '.repository.url // empty' "$f")"
+    if [[ -z "$url" ]]; then
+        report "$f: no .repository.url (npm rejects provenance without it)"
+    elif [[ "$url" != "$expected_repo" ]]; then
+        report "$f: repository.url is '$url', expected '$expected_repo'"
+    fi
+done
+
 if [[ $fail -ne 0 ]]; then
     echo "FAIL: manifests disagree${expect:+ with tag $expect}" >&2
     exit 1