chore: migrate repository URLs from AnsoCode/Sencho to studio-saelix/sencho

Updates all hardcoded GitHub repository references across 21 files: - package.json: repository URL, bugs URL, homepage, description, author - CONTRIBUTING.md: bug report template URL - SECURITY.md: advisory URL, cosign cert-identity regexp - .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers - .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL - .github/workflows/cla.yml: path-to-document URL - .github/workflows/docker-publish.yml: cosign verify comment - frontend/**/*.tsx: issues and changelog links (3 components) - frontend/public/.well-known/security.txt: Contact and Policy URLs - security/vex/sencho.openvex.json: @id field - docs/openapi.yaml: license URL - docs/docs.json: navbar and footer GitHub links (5 instances) - docs/security.mdx: advisory and SECURITY.md links - docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note - docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links - docs/reference/security-advisories.mdx: releases link - docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances) - docs/operations/upgrade.mdx: releases links (2 instances) - backend/src/utils/version-check.ts: GitHub Releases API endpoint CHANGELOG.md intentionally excluded (release-please managed). Legacy cosign identity note added for pre-migration image verification.
2026-07-26 11:49:16 +00:00 · 2026-04-29 09:24:20 -04:00
parent c8287e43a0
commit 3da0aa6036
21 changed files with 50 additions and 45 deletions
@@ -1,2 +1,2 @@
 # Default owner for everything
-* @AnsoCode
+* @studio-saelix/maintainers
@@ -252,7 +252,7 @@ jobs:
          app-id: ${{ secrets.APP_ID }}
          private-key: ${{ secrets.APP_PRIVATE_KEY }}
          owner: ${{ github.repository_owner }}
-          repositories: Sencho
+          repositories: sencho
          permission-contents: write
          permission-pull-requests: write

@@ -339,7 +339,7 @@ jobs:
        run: |
          rm -rf sencho-docs

-          REMOTE="https://x-access-token:${DOCS_TOKEN}@github.com/AnsoCode/sencho-docs.git"
+          REMOTE="https://x-access-token:${DOCS_TOKEN}@github.com/studio-saelix/sencho-docs.git"

          if git clone "${REMOTE}" sencho-docs 2>/dev/null; then
            echo "Cloned existing sencho-docs."
@@ -24,6 +24,6 @@ jobs:
          # PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
        with:
          path-to-signatures: 'signatures/version1/cla.json'
-          path-to-document: 'https://github.com/AnsoCode/Sencho/blob/main/CLA.md'
+          path-to-document: 'https://github.com/studio-saelix/sencho/blob/main/CLA.md'
          branch: 'main'
          allowlist: 'dependabot[bot],greenkeeper[bot],github-actions[bot],release-please[bot],sencho-quartermaster[bot]'
@@ -170,7 +170,7 @@ jobs:
        # Signs every tag produced by metadata-action using the ambient GitHub
        # OIDC token. No private keys, no secrets. Users verify with:
        #   cosign verify saelix/sencho:<tag> \
-        #     --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
+        #     --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
        #     --certificate-oidc-issuer https://token.actions.githubusercontent.com
        # Each ref is pinned to the immutable digest so signatures are bound to
        # the exact manifest, not the mutable tag pointer.
@@ -80,7 +80,7 @@ Before writing code for a new gated feature, please open an issue to discuss it

 ## Reporting Bugs

-Use the [bug report template](https://github.com/AnsoCode/Sencho/issues/new?template=bug_report.yml). Include: deployment method, Sencho version, browser (for UI issues), steps to reproduce, and expected vs actual behavior.
+Use the [bug report template](https://github.com/studio-saelix/sencho/issues/new?template=bug_report.yml). Include: deployment method, Sencho version, browser (for UI issues), steps to reproduce, and expected vs actual behavior.

 ## Code Style

@@ -16,7 +16,7 @@ Sencho is self-hosted software. Always run the latest release to receive securit
 You can report security issues in two ways:

 1. **Email:** Send details to **security@sencho.io**
-2. **GitHub:** Use [private vulnerability reporting](https://github.com/AnsoCode/Sencho/security/advisories/new) in the Security tab
+2. **GitHub:** Use [private vulnerability reporting](https://github.com/studio-saelix/sencho/security/advisories/new) in the Security tab

 In your report, include: steps to reproduce, impact assessment, and any suggested fixes.

@@ -40,7 +40,7 @@ Quick summary:
 ```bash
 # Verify image signature (cosign keyless, Rekor logged)
 cosign verify saelix/sencho:<tag> \
-  --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
+  --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com

 # Scan with VEX applied (zero unresolved HIGH/CRITICAL CVEs)
@@ -8,7 +8,7 @@ import { CacheService } from '../services/CacheService';
 */

 async function fetchFromGitHub(): Promise<string | null> {
-  const res = await fetch('https://api.github.com/repos/AnsoCode/Sencho/releases/latest', {
+  const res = await fetch('https://api.github.com/repos/studio-saelix/sencho/releases/latest', {
    headers: { Accept: 'application/vnd.github+json', 'User-Agent': 'Sencho' },
    signal: AbortSignal.timeout(10000),
  });
@@ -29,7 +29,7 @@
    "links": [
      {
        "type": "github",
-        "href": "https://github.com/AnsoCode/Sencho"
+        "href": "https://github.com/studio-saelix/sencho"
      }
    ],
    "primary": {
@@ -40,7 +40,7 @@
  },
  "footer": {
    "socials": {
-      "github": "https://github.com/AnsoCode/Sencho"
+      "github": "https://github.com/studio-saelix/sencho"
    },
    "links": [
      {
@@ -48,14 +48,14 @@
        "items": [
          { "label": "Website", "href": "https://sencho.io" },
          { "label": "Pricing", "href": "https://sencho.io/#pricing" },
-          { "label": "Changelog", "href": "https://github.com/AnsoCode/Sencho/releases" }
+          { "label": "Changelog", "href": "https://github.com/studio-saelix/sencho/releases" }
        ]
      },
      {
        "header": "Community",
        "items": [
-          { "label": "GitHub", "href": "https://github.com/AnsoCode/Sencho" },
-          { "label": "Contributing", "href": "https://github.com/AnsoCode/Sencho/blob/main/CONTRIBUTING.md" }
+          { "label": "GitHub", "href": "https://github.com/studio-saelix/sencho" },
+          { "label": "Contributing", "href": "https://github.com/studio-saelix/sencho/blob/main/CONTRIBUTING.md" }
        ]
      },
      {
@@ -32,7 +32,7 @@ info:
    url: https://sencho.io
  license:
    name: BSL 1.1
-    url: https://github.com/AnsoCode/Sencho/blob/main/LICENSE
+    url: https://github.com/studio-saelix/sencho/blob/main/LICENSE

 servers:
  - url: "{protocol}://{host}:{port}"
@@ -65,7 +65,7 @@ If you prefer to control exactly which version you run, pin the image tag in you
 image: saelix/sencho:0.38.0
 ```

-Check [GitHub Releases](https://github.com/AnsoCode/Sencho/releases) for available versions and changelogs.
+Check [GitHub Releases](https://github.com/studio-saelix/sencho/releases) for available versions and changelogs.

 ---

@@ -83,4 +83,4 @@ Sencho follows [Semantic Versioning](https://semver.org/) (`MAJOR.MINOR.PATCH`):
  While the version is below 1.0, minor releases (0.x.0) may occasionally include breaking changes. These are always documented in the release notes. Once Sencho reaches 1.0, breaking changes will only occur in major releases.
 </Note>

-Breaking changes are marked with `BREAKING CHANGE` in the [release notes](https://github.com/AnsoCode/Sencho/releases). Subscribe to the repository's releases to be notified of new versions.
+Breaking changes are marked with `BREAKING CHANGE` in the [release notes](https://github.com/studio-saelix/sencho/releases). Subscribe to the repository's releases to be notified of new versions.
@@ -29,7 +29,7 @@ Every published tag is signed with cosign keyless signing via GitHub Actions OID

 ```bash
 cosign verify saelix/sencho:<tag> \
-  --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
+  --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
 ```

@@ -46,7 +46,7 @@ BuildKit produces an SLSA v1 provenance attestation during every multi-arch buil
 ```bash
 cosign verify-attestation \
  --type slsaprovenance \
-  --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
+  --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
 ```
@@ -56,7 +56,7 @@ cosign verify-attestation \
 ```bash
 cosign verify-attestation \
  --type cyclonedx \
-  --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
+  --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
 ```
@@ -68,7 +68,7 @@ Alternatively, download `sbom.cdx.json` directly from the GitHub Release assets
 ```bash
 cosign verify-attestation \
  --type spdxjson \
-  --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
+  --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
 ```
@@ -82,7 +82,7 @@ The OpenVEX document explains Sencho's triage decisions for any CVEs that appear
 ```bash
 cosign verify-attestation \
  --type openvex \
-  --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
+  --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
 ```
@@ -96,7 +96,7 @@ To reproduce the same scan that gates every release:
 ```bash
 # Download the VEX document
 curl -Lo sencho.openvex.json \
-  https://github.com/AnsoCode/Sencho/releases/latest/download/sencho.openvex.json
+  https://github.com/studio-saelix/sencho/releases/latest/download/sencho.openvex.json

 # Scan with VEX applied (exit 1 if any unresolved HIGH/CRITICAL CVE)
 trivy image \
@@ -11,7 +11,7 @@ Sencho provides dedicated email channels for different types of inquiries. Use t
  Technical support, how-to questions, and troubleshooting help. Available to Skipper and Admiral license holders via **Settings > Help & Support** in the app.
 </Card>

-Community users can get help through the [Documentation](https://docs.sencho.io) and [GitHub Issues](https://github.com/AnsoCode/Sencho/issues).
+Community users can get help through the [Documentation](https://docs.sencho.io) and [GitHub Issues](https://github.com/studio-saelix/sencho/issues).

 ## General inquiries

@@ -26,7 +26,7 @@ Community users can get help through the [Documentation](https://docs.sencho.io)
 </Card>

 This address appears in:
- The [LICENSE](https://github.com/AnsoCode/Sencho/blob/main/LICENSE) file for alternative licensing inquiries
+- The [LICENSE](https://github.com/studio-saelix/sencho/blob/main/LICENSE) file for alternative licensing inquiries
 - Upgrade prompts inside the app (paywall screens)
 - The [Refund Policy](https://sencho.io/refund) and pricing section on the website

@@ -36,9 +36,9 @@ This address appears in:
  Vulnerability reports, security incidents, and bug bounty submissions. **Do not open a public issue for security vulnerabilities.**
 </Card>

-You can also use [GitHub private vulnerability reporting](https://github.com/AnsoCode/Sencho/security/advisories/new). Both the app and the website publish a `/.well-known/security.txt` file that points to this address.
+You can also use [GitHub private vulnerability reporting](https://github.com/studio-saelix/sencho/security/advisories/new). Both the app and the website publish a `/.well-known/security.txt` file that points to this address.

-See the full [Security Policy](https://github.com/AnsoCode/Sencho/blob/main/SECURITY.md) for response times and disclosure guidelines.
+See the full [Security Policy](https://github.com/studio-saelix/sencho/blob/main/SECURITY.md) for response times and disclosure guidelines.

 ## Privacy

@@ -54,7 +54,7 @@ This address is listed in the [Privacy Policy](https://sencho.io/privacy) and [T
  Reports of Code of Conduct violations in any Sencho community space.
 </Card>

-All reports are reviewed promptly and handled with confidentiality. See the [Code of Conduct](https://github.com/AnsoCode/Sencho/blob/main/CODE_OF_CONDUCT.md) for details.
+All reports are reviewed promptly and handled with confidentiality. See the [Code of Conduct](https://github.com/studio-saelix/sencho/blob/main/CODE_OF_CONDUCT.md) for details.

 ## Summary

@@ -59,5 +59,5 @@ The following dependency upgrades resolved all known CVEs at time of release:
 Sencho tracks and remediates dependency CVEs with each release. Dependency versions are pinned in the Dockerfile for reproducible builds and targeted remediation independent of Alpine's release cycle.

 <Note>
-  If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/AnsoCode/Sencho/releases) where each release documents dependency changes.
+  If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/studio-saelix/sencho/releases) where each release documents dependency changes.
 </Note>
@@ -15,7 +15,7 @@ Every image also ships with an embedded SBOM (Software Bill of Materials) and [S

 Verification guarantees:

-1. The image was built from the [AnsoCode/Sencho](https://github.com/AnsoCode/Sencho) repository on GitHub.
+1. The image was built from the [studio-saelix/sencho](https://github.com/studio-saelix/sencho) repository on GitHub.
 2. The build ran inside a GitHub Actions workflow, not on someone's laptop.
 3. The image has not been tampered with between publish and pull.

@@ -51,10 +51,15 @@ Replace `<tag>` with the version you intend to pull, for example `0.42.7`, `0.42

 ```bash
 cosign verify saelix/sencho:<tag> \
-  --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
+  --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com
 ```

+<Note>
+  Images released before the repository migration (prior to v0.65.x) were signed with the identity `https://github.com/AnsoCode/Sencho/...`. To verify those older images, use the combined regexp:
+  `"https://github.com/(AnsoCode/Sencho|studio-saelix/sencho)/.*"`
+</Note>
+
 A successful verification prints the signature, the Rekor transparency log entry, and the certificate that signed it. If the image is not signed by the official Sencho pipeline, the command exits with a non-zero status and you should not run that image.

 ## Inspect the SBOM and provenance
@@ -260,6 +260,6 @@ For copy-paste verification commands, see [Verifying Images](/operations/verifyi

 ## Reporting a vulnerability

-If you discover a security vulnerability in Sencho, please report it privately via [security@sencho.io](mailto:security@sencho.io) or through [GitHub private vulnerability reporting](https://github.com/AnsoCode/Sencho/security/advisories/new). Do not open a public issue for security vulnerabilities.
+If you discover a security vulnerability in Sencho, please report it privately via [security@sencho.io](mailto:security@sencho.io) or through [GitHub private vulnerability reporting](https://github.com/studio-saelix/sencho/security/advisories/new). Do not open a public issue for security vulnerabilities.

-See the full [Security Policy](https://github.com/AnsoCode/Sencho/blob/main/SECURITY.md) for response times and disclosure guidelines.
+See the full [Security Policy](https://github.com/studio-saelix/sencho/blob/main/SECURITY.md) for response times and disclosure guidelines.
@@ -1,6 +1,6 @@
 Contact: mailto:security@sencho.io
-Contact: https://github.com/AnsoCode/Sencho/security/advisories/new
+Contact: https://github.com/studio-saelix/sencho/security/advisories/new
 Expires: 2027-12-31T23:59:00.000Z
 Preferred-Languages: en
 Canonical: https://sencho.io/.well-known/security.txt
-Policy: https://github.com/AnsoCode/Sencho/blob/main/SECURITY.md
+Policy: https://github.com/studio-saelix/sencho/blob/main/SECURITY.md
@@ -151,7 +151,7 @@ export function UserProfileDropdown({ theme, setTheme, onOpenSettings }: UserPro
                    <MenuRow
                        icon={MessageSquare}
                        label="Feedback"
-                        href="https://github.com/AnsoCode/Sencho/issues"
+                        href="https://github.com/studio-saelix/sencho/issues"
                        external
                    />
                </div>
@@ -32,7 +32,7 @@ export function AboutSection() {
                <h4 className="text-sm font-medium">Links</h4>
                <div className="flex flex-col gap-1.5">
                    <a
-                        href="https://github.com/AnsoCode/Sencho/blob/main/CHANGELOG.md"
+                        href="https://github.com/studio-saelix/sencho/blob/main/CHANGELOG.md"
                        target="_blank"
                        rel="noopener noreferrer"
                        className="text-sm text-muted-foreground hover:text-foreground transition-colors"
@@ -23,7 +23,7 @@ export function SupportSection() {
                        </div>
                        <ExternalLink className="w-4 h-4 text-muted-foreground shrink-0" />
                    </a>
-                    <a href="https://github.com/AnsoCode/Sencho/issues" target="_blank" rel="noopener noreferrer"
+                    <a href="https://github.com/studio-saelix/sencho/issues" target="_blank" rel="noopener noreferrer"
                       className="flex items-center gap-3 p-3 rounded-lg border border-glass-border hover:bg-muted/50 transition-colors">
                        <div className="w-9 h-9 rounded-lg bg-muted flex items-center justify-center shrink-0">
                            <Bug className="w-4 h-4" />
@@ -1,7 +1,7 @@
 {
  "name": "sencho",
  "version": "0.65.0",
-  "description": "",
+  "description": "Self-hosted Docker control plane for Compose with atomic deployments, self-healing, and fleet-wide automation.",
  "main": "index.js",
  "scripts": {
    "test": "cd backend && npm test",
@@ -10,18 +10,18 @@
  },
  "repository": {
    "type": "git",
-    "url": "git+https://github.com/AnsoCode/Sencho.git"
+    "url": "git+https://github.com/studio-saelix/sencho.git"
  },
  "keywords": [],
-  "author": "",
+  "author": "Studio Saelix",
  "license": "SEE LICENSE IN LICENSE",
  "type": "commonjs",
  "bugs": {
-    "url": "https://github.com/AnsoCode/Sencho/issues"
+    "url": "https://github.com/studio-saelix/sencho/issues"
  },
-  "homepage": "https://github.com/AnsoCode/Sencho#readme",
+  "homepage": "https://github.com/studio-saelix/sencho#readme",
  "devDependencies": {
    "@playwright/test": "^1.59.1",
    "otplib": "^13.4.0"
  }
-}
+}
@@ -1,6 +1,6 @@
 {
  "@context": "https://openvex.dev/ns/v0.2.0",
-  "@id": "https://github.com/AnsoCode/Sencho/security/vex/sencho.openvex.json",
+  "@id": "https://github.com/studio-saelix/sencho/security/vex/sencho.openvex.json",
  "author": "Studio Saelix",
  "role": "Vendor",
  "timestamp": "2026-04-29T00:00:00Z",