fix: clarify provenance repository match url is case-sensitive (#1123)
Clarify that the repository url is matched case-sensitive so users don't need to find out by trial and error. GitHub user names are case-insensitive which means you can use `/username/repository` or `/UserName/repository` as valid repository url. But provenance seems to check for exact match which can be confusing to people adding provenance to their package on GitHub when the url does not satisfy provenance.
Claas committed
May 29, 2024 at 03:50 UTC
5a8e163581c96ca8fc594ae2bd899d18f5b34cfb
1 file changed
+1
-1
content/packages-and-modules/securing-your-code/generating-provenance-statements.mdx
+1
-1
@@ -36,7 +36,7 @@ Before you can publish your packages with provenance, you must:
36
37
- Install the latest version of the npm CLI (ensure you are on `9.5.0+` as older versions don't support npm provenance). For more information, see "[Try the latest stable version of npm][update-npm]."
38
39
-- Ensure your `package.json` is configured with a public `repository` that matches where you are publishing with provenance from.
39
+- Ensure your `package.json` is configured with a public `repository` that matches (case-sensitive) where you are publishing with provenance from.
40
41
- Set up automation with a supported CI/CD provider to publish your packages to the npm registry. The following providers are supported:
42
- GitHub Actions. For more information, see "[Publishing packages with provenance via GitHub Actions][github-provenance]."