Add repository field to fix provenance validation on publish

[taarikashenafi]

Add repository field to fix npm provenance validation

The v1.0.0 publish failed with E422 Unprocessable Entity because
package.json had no repository field. Publishing with --provenance
requires repository.url to match the repo the build ran in
(https://github.com/github/accessibility-scanner-alt-text-plugin), and an
empty value fails Sigstore provenance validation:

npm error code E422
npm error 422 Unprocessable Entity - PUT https://registry.npmjs.org/@github%2faccessibility-scanner-alt-text-plugin - Error verifying sigstore provenance bundle: Failed to validate repository information: package.json: "repository.url" is "", expected to match "https://github.com/github/accessibility-scanner-alt-text-plugin" from provenance

This adds the repository field so provenance validation passes.

Once merged, I'll recreate the v1.0.0 release so the tag includes this fix
and the package publishes to npm.

Part of github/accessibility#10755

[Copilot]

Pull request overview

This PR fixes npm provenance validation failures during npm publish --provenance by adding the missing repository field to package.json, so the package metadata can be matched to the GitHub repository that produced the provenance attestation.

Changes:

• Add repository metadata (type + url) to package.json to satisfy npm/Sigstore provenance validation.

Show a summary per file

File	Description
package.json	Adds repository metadata required for npm publish --provenance to validate provenance against the GitHub repo.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Low