From efcc5f0052dd27505d0c574bb1a9e9aa3e6245ae Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Thu, 13 Aug 2026 11:06:02 -0700
Subject: [PATCH] fix(release): align npm trusted publisher identity

---
 .github/workflows/release.yml | 1 +
 CHANGELOG.md                  | 1 +
 docs/release-prep.md          | 3 +++
 package.json                  | 4 ++++
 4 files changed, 9 insertions(+)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 96faeb4..f0afa93 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,6 +17,7 @@ jobs:
   release:
     name: Publish npm and GitHub release
     runs-on: ubuntu-latest
+    environment: npm-release
     timeout-minutes: 20
     permissions:
       contents: write
diff --git a/CHANGELOG.md b/CHANGELOG.md
index 530dd33..feb4009 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ## 0.7.3 - Unreleased
 
+- Bound npm trusted publishing to the `npm-release` GitHub environment and restored canonical package repository metadata.
 - Reworked the README around a verified install and quickstart path, with deeper command, mapper, provider, and safety details linked to the existing docs.
 - Updated transitive Vitest dependencies.
 - Updated pnpm, formatter and linter tooling, and GitHub Actions dependencies.
diff --git a/docs/release-prep.md b/docs/release-prep.md
index d34778d..266fdc8 100644
--- a/docs/release-prep.md
+++ b/docs/release-prep.md
@@ -38,6 +38,9 @@ npm pack --dry-run --json --ignore-scripts
 
 ## Manual Checks
 
+- Confirm npm Trusted Publisher is bound to GitHub repository
+  `openclaw/clawpatch`, workflow filename `release.yml`, environment
+  `npm-release`, and the `npm publish` action.
 - Confirm `CHANGELOG.md` has all user-visible, operational, or security-relevant
   changes under the next unreleased version.
 - Confirm README and docs mention any new mapper behavior, commands, or safety
diff --git a/package.json b/package.json
index e5c1dd8..2439a6c 100644
--- a/package.json
+++ b/package.json
@@ -3,6 +3,10 @@
   "version": "0.7.2",
   "description": "Automated code review that lands fixes.",
   "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/openclaw/clawpatch.git"
+  },
   "bin": {
     "clawpatch": "dist/cli.js"
   },