Second attempt at trusted publishing

.gitlab-ci.yml

@@ -50,12 +50,14 @@ test-integration:
 
 publish:
   extends: .node-common
-  # npm trusted publishing via GitLab OIDC — requires instance runner for OIDC support.
+  # npm trusted publishing via GitLab OIDC — no NPM_TOKEN needed.
   # Each @wizardconnect/* package must be linked to this GitLab project
   # on npmjs.com: package Settings > Publishing access > Trusted publishers.
   tags:
-    - saas-linux-small-amd64 # force gitlab instance runner
+    - saas-linux-small-amd64 # force gitlab instance runner (not self hosted)
   id_tokens:
+    NPM_ID_TOKEN:
+      aud: "npm:registry.npmjs.org"
     SIGSTORE_ID_TOKEN:
       aud: sigstore
   script:
@@ -88,8 +90,10 @@ pages:
 force-publish:
   extends: .node-common
   tags:
-    - saas-linux-small-amd64 # force gitlab instance runners
+    - saas-linux-small-amd64 # force gitlab instance runner (not self hosted)
   id_tokens:
+    NPM_ID_TOKEN:
+      aud: "npm:registry.npmjs.org"
     SIGSTORE_ID_TOKEN:
       aud: sigstore
   script:

contrib/auto-publish.js

@@ -130,7 +130,7 @@ function publishPackage(packagePath, packageName) {
   log(`Publishing ${packageName}`);
 
   try {
-    execCommand('npm publish --provenance --access public', packagePath);
+    execCommand('npm publish --access public', packagePath);
     log(`Successfully published ${packageName}`);
   } catch (error) {
     log(`Failed to publish ${packageName}: ${error.message}`);

contrib/force-publish.js

@@ -114,7 +114,7 @@ function publishPackage(packagePath, packageName) {
   log(`Publishing ${packageName}`);
 
   try {
-    execCommand('npm publish --provenance --access public', packagePath);
+    execCommand('npm publish --access public --loglevel verbose', packagePath);
     log(`Successfully published ${packageName}`);
   } catch (error) {
     log(`Failed to publish ${packageName}: ${error.message}`);

packages/core/package.json

@@ -3,6 +3,11 @@
   "version": "0.1.2",
   "type": "module",
   "description": "Transport and protocol primitives for WizardConnect",
+  "repository": {
+    "type": "git",
+    "url": "https://gitlab.com/riftenlabs/lib/wizardconnect",
+    "directory": "packages/core"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [

packages/dapp/package.json

@@ -3,6 +3,11 @@
   "version": "0.1.2",
   "type": "module",
   "description": "Dapp-side integration helpers for WizardConnect",
+  "repository": {
+    "type": "git",
+    "url": "https://gitlab.com/riftenlabs/lib/wizardconnect",
+    "directory": "packages/dapp"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [

packages/wallet/package.json

@@ -3,6 +3,11 @@
   "version": "0.1.2",
   "type": "module",
   "description": "Wallet-side integration helpers for WizardConnect",
+  "repository": {
+    "type": "git",
+    "url": "https://gitlab.com/riftenlabs/lib/wizardconnect",
+    "directory": "packages/wallet"
+  },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "files": [