From f8c585efc9b784d142db7493bd075119fbfcfe09 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Robin=20Br=C3=A4mer?=
 <22003767+robinbraemer@users.noreply.github.com>
Date: Fri, 14 Aug 2026 00:00:16 +0200
Subject: [PATCH] fix(release): retain renamed repository provenance

Rationale: release staging overwrote npm package provenance and GitHub release notes with the pre-rename repository coordinate, even though committed manifests had been corrected.\n\nRisk: affects only metadata emitted during release publication; immutable artifact build and package behavior remain unchanged.\n\nTested: mise exec -- task fmt:check; mise exec -- task release:check-workflows
---
 .github/workflows/release-publish.yml | 4 ++--
 .github/workflows/release.yml         | 6 +++---
 scripts/check-release-workflows.sh    | 3 +++
 3 files changed, 8 insertions(+), 5 deletions(-)

diff --git a/.github/workflows/release-publish.yml b/.github/workflows/release-publish.yml
index 8cc2a2c..cf32e86 100644
--- a/.github/workflows/release-publish.yml
+++ b/.github/workflows/release-publish.yml
@@ -184,7 +184,7 @@ jobs:
         run: |
           set -eu
           version="${{ needs.detect-version.outputs.version }}"
-          repo='git+https://github.com/akua-dev/akua.git'
+          repo='git+https://github.com/akua-dev/akuapkg.git'
           jq --arg v "$version" --arg repo "$repo" \
             '.version = $v
              | .dependencies["@akua-dev/native-engines"] = $v
@@ -229,7 +229,7 @@ jobs:
         run: |
           set -eu
           version="${{ needs.detect-version.outputs.version }}"
-          repo='git+https://github.com/akua-dev/akua.git'
+          repo='git+https://github.com/akua-dev/akuapkg.git'
           cp crates/akua-napi/artifacts/wasm-bundle/crates/helm-engine-wasm/assets/helm-engine.wasm \
              crates/akua-native-engines-npm/helm-engine.wasm
           cp crates/akua-napi/artifacts/wasm-bundle/crates/kustomize-engine-wasm/assets/kustomize-engine.wasm \
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index bc67705..cd89d3d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -450,8 +450,8 @@ jobs:
         run: |
           set -eu
           version="${{ needs.detect-version.outputs.version }}"
-          repo='git+https://github.com/akua-dev/akua.git'
-          homepage='https://github.com/akua-dev/akua#readme'
+          repo='git+https://github.com/akua-dev/akuapkg.git'
+          homepage='https://github.com/akua-dev/akuapkg#readme'
           echo "Preparing @akua-dev/sdk@${version}"
           jq --arg v "$version" --arg repo "$repo" --arg homepage "$homepage" \
             '.version = $v
@@ -662,7 +662,7 @@ jobs:
           IS_PRERELEASE: ${{ needs.detect-version.outputs.is_prerelease }}
         run: |
           set -eu
-          notes="See [CHANGELOG.md](https://github.com/akua-dev/akua/blob/main/CHANGELOG.md) for details."
+          notes="See [CHANGELOG.md](https://github.com/akua-dev/akuapkg/blob/main/CHANGELOG.md) for details."
           if [[ "$GITHUB_EVENT_NAME" == "workflow_dispatch" ]]; then
             gh release view "${TAG}" --repo "${GH_REPO}" > /dev/null
             echo "Verified existing immutable Release ${TAG}; recovery does not upload or replace assets."
diff --git a/scripts/check-release-workflows.sh b/scripts/check-release-workflows.sh
index 0b6c3e9..770c01e 100644
--- a/scripts/check-release-workflows.sh
+++ b/scripts/check-release-workflows.sh
@@ -335,6 +335,9 @@ assert_job_contains ".github/workflows/release.yml" \
 assert_job_contains ".github/workflows/release.yml" \
 	"sdk-build" \
 	'.homepage = $homepage'
+assert_file_excludes ".github/workflows/release.yml" "github.com/akua-dev/akua.git"
+assert_file_excludes ".github/workflows/release.yml" "github.com/akua-dev/akua/blob"
+assert_file_excludes ".github/workflows/release-publish.yml" "github.com/akua-dev/akua.git"
 
 # The external trusted-publisher identity and the deliberately gated recovery
 # command are authoritative release contract, not tribal knowledge.