fix(release): satisfy npm provenance so packages actually publish

backend/cli/script/build.ts

@@ -189,6 +189,12 @@ for (const item of targets) {
         version: Script.version,
         os: [item.os],
         cpu: [item.arch],
+        // npm provenance refuses packages whose repository.url doesn't match
+        // the repo the workflow ran from (case-sensitive)
+        repository: {
+          type: "git",
+          url: "git+https://github.com/synthetic-sciences/openscience.git",
+        },
       },
       null,
       2,

backend/cli/script/publish.ts

@@ -39,6 +39,12 @@ await Bun.file(`./dist/${pkg.name}/package.json`).write(
         postinstall: "bun ./postinstall.mjs || node ./postinstall.mjs",
       },
       version: version,
+      // npm provenance refuses packages whose repository.url doesn't match
+      // the repo the workflow ran from (case-sensitive)
+      repository: {
+        type: "git",
+        url: "git+https://github.com/synthetic-sciences/openscience.git",
+      },
       optionalDependencies: binaries,
     },
     null,

package.json

@@ -81,7 +81,7 @@
   },
   "repository": {
     "type": "git",
-    "url": "https://github.com/synthetic-sciences/OpenScience"
+    "url": "https://github.com/synthetic-sciences/openscience"
   },
   "license": "Apache-2.0",
   "prettier": {

tooling/launcher/package.json

@@ -22,7 +22,7 @@
   ],
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/synthetic-sciences/OpenScience.git"
+    "url": "git+https://github.com/synthetic-sciences/openscience.git"
   },
   "homepage": "https://syntheticsciences.ai"
 }

tooling/plugin/package.json

@@ -24,5 +24,9 @@
     "@types/node": "catalog:",
     "typescript": "catalog:",
     "@typescript/native-preview": "catalog:"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/synthetic-sciences/openscience.git"
   }
-}
+}

tooling/repo/publish.ts

@@ -59,25 +59,33 @@ if (Script.release) {
   await $`gh release edit v${Script.version} --draft=false`.nothrow()
 }
 
+// Sections keep publishing past an earlier failure so a broken CLI publish
+// doesn't block the SDK, but any failure must fail the workflow at the end —
+// a green run previously meant nothing reached npm at all.
+const failures: string[] = []
+
 console.log("\n=== cli ===\n")
 try {
   await import(`../../backend/cli/script/publish.ts`)
 } catch (e) {
   console.error("CLI publish failed:", e)
+  failures.push("cli")
 }
 
 console.log("\n=== sdk ===\n")
 try {
   await import(`../sdk/js/script/publish.ts`)
 } catch (e) {
   console.error("SDK publish failed:", e)
+  failures.push("sdk")
 }
 
 console.log("\n=== plugin ===\n")
 try {
   await import(`../plugin/script/publish.ts`)
 } catch (e) {
   console.error("Plugin publish failed:", e)
+  failures.push("plugin")
 }
 
 console.log("\n=== launcher (openscience) ===\n")
@@ -104,10 +112,17 @@ try {
   // without polluting node_modules/.bin in the npx temp tree.
   delete launcherPkg.dependencies
   await Bun.file(`${launcherDir}/package.json`).write(JSON.stringify(launcherPkg, null, 2))
-  await $`cd ${launcherDir} && npm publish --access public --tag ${Script.channel}`.nothrow()
+  const result = await $`cd ${launcherDir} && npm publish --access public --tag ${Script.channel}`.nothrow()
+  if (result.exitCode !== 0) throw new Error(`npm publish exited with ${result.exitCode}`)
 } catch (e) {
   console.error("Launcher publish failed:", e)
+  failures.push("launcher")
 }
 
 const dir = new URL("../..", import.meta.url).pathname
 process.chdir(dir)
+
+if (failures.length > 0) {
+  console.error(`\npublish failed for: ${failures.join(", ")}`)
+  process.exit(1)
+}

tooling/sdk/js/package.json

@@ -29,5 +29,9 @@
   "dependencies": {},
   "publishConfig": {
     "directory": "dist"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/synthetic-sciences/openscience.git"
   }
-}
+}