fix: provenance & oidc

[TobiTenno]

What did you fix?

provenance & oidc

---

Reproduction steps

do a release

---

Evidence/screenshot/link to line

Considerations

• Does this contain a new dependency? [No]
• Does this introduce opinionated data formatting or manual data entry? [No]
• Does this pr include updated data files in a separate commit that can be reverted for a clean code-only pr? [No]
• Have I run the linter? [Yes]
• Is is a bug fix, feature request, or enhancement? [Security]

Summary by CodeRabbit

• Chores
  • Updated release automation permissions to support publishing and issue management.
  • Standardized repository metadata URL casing.
  • Enabled provenance for published packages to include build attestation.

[coderabbitai]

Walkthrough

Updated CI release workflow permissions to include write access for id-token, contents, pull-requests, and issues. In package.json, corrected repository URL casing and added a top-level publishConfig with provenance enabled.

Changes

Cohort / File(s)	Summary
CI Workflow Permissions \.github/workflows/release.yaml	Added permissions: id-token, contents, pull-requests, issues (write). No step changes; minor whitespace addition.
Package Metadata package.json	Updated repository URL to https://github.com/WFCD/arsenal-parser; added "publishConfig": { "provenance": true }.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

Suggested labels

released

Suggested reviewers

• AyAyEm

Poem

I twitch my whiskers at the tag so bright,
A release hops forth in the moonlit night.
Provenance packed, permissions aligned,
URLs cased—oh, so refined.
Thump-thump goes CI, green lights gleam,
Carrots for all in the shipping stream! 🥕✨

Pre-merge checks and finishing touches

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title “fix: provenance & oidc” succinctly captures the core changes of this pull request by referencing both the addition of provenance support in package.json and the OIDC permissions update in the GitHub Actions workflow, without extraneous details or ambiguity.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

✨ Finishing touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Post copyable unit tests in a comment
• Commit unit tests in branch TobiTenno-patch-1

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 0

🧹 Nitpick comments (1)

.github/workflows/release.yaml (1)

44-44: Trim the trailing blank line.

YAMLlint flags Line 44 for an extra blank line. Please drop it to keep the workflow lint-clean.

📜 Review details

Configuration used: CodeRabbit UI

Review profile: CHILL

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 13c71f6 and e519062.

📒 Files selected for processing (2)

• .github/workflows/release.yaml (2 hunks)
• package.json (2 hunks)

🧰 Additional context used

🪛 YAMLlint (1.37.1)

.github/workflows/release.yaml

[warning] 44-44: too many blank lines (1 > 0)

(empty-lines)

[wfcd-bot-boi]

🎉 This PR is included in version 2.0.5 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀