From 3da0aa6036530dbd358e928676b2721106b249a3 Mon Sep 17 00:00:00 2001 From: SaelixCode Date: Wed, 29 Apr 2026 09:24:20 -0400 Subject: [PATCH] chore: migrate repository URLs from AnsoCode/Sencho to studio-saelix/sencho Updates all hardcoded GitHub repository references across 21 files: - package.json: repository URL, bugs URL, homepage, description, author - CONTRIBUTING.md: bug report template URL - SECURITY.md: advisory URL, cosign cert-identity regexp - .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers - .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL - .github/workflows/cla.yml: path-to-document URL - .github/workflows/docker-publish.yml: cosign verify comment - frontend/**/*.tsx: issues and changelog links (3 components) - frontend/public/.well-known/security.txt: Contact and Policy URLs - security/vex/sencho.openvex.json: @id field - docs/openapi.yaml: license URL - docs/docs.json: navbar and footer GitHub links (5 instances) - docs/security.mdx: advisory and SECURITY.md links - docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note - docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links - docs/reference/security-advisories.mdx: releases link - docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances) - docs/operations/upgrade.mdx: releases links (2 instances) - backend/src/utils/version-check.ts: GitHub Releases API endpoint CHANGELOG.md intentionally excluded (release-please managed). Legacy cosign identity note added for pre-migration image verification. --- .github/CODEOWNERS | 2 +- .github/workflows/ci.yml | 4 ++-- .github/workflows/cla.yml | 2 +- .github/workflows/docker-publish.yml | 2 +- CONTRIBUTING.md | 2 +- SECURITY.md | 4 ++-- backend/src/utils/version-check.ts | 2 +- docs/docs.json | 10 +++++----- docs/openapi.yaml | 2 +- docs/operations/upgrade.mdx | 4 ++-- docs/operations/verifying-images.mdx | 12 ++++++------ docs/reference/contact.mdx | 10 +++++----- docs/reference/security-advisories.mdx | 2 +- docs/reference/verifying-images.mdx | 9 +++++++-- docs/security.mdx | 4 ++-- frontend/public/.well-known/security.txt | 4 ++-- frontend/src/components/UserProfileDropdown.tsx | 2 +- frontend/src/components/settings/AboutSection.tsx | 2 +- frontend/src/components/settings/SupportSection.tsx | 2 +- package.json | 12 ++++++------ security/vex/sencho.openvex.json | 2 +- 21 files changed, 50 insertions(+), 45 deletions(-) diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS index edaa3bfa..17b0fff5 100644 --- a/.github/CODEOWNERS +++ b/.github/CODEOWNERS @@ -1,2 +1,2 @@ # Default owner for everything -* @AnsoCode +* @studio-saelix/maintainers diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 7381d000..202ef394 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -252,7 +252,7 @@ jobs: app-id: ${{ secrets.APP_ID }} private-key: ${{ secrets.APP_PRIVATE_KEY }} owner: ${{ github.repository_owner }} - repositories: Sencho + repositories: sencho permission-contents: write permission-pull-requests: write @@ -339,7 +339,7 @@ jobs: run: | rm -rf sencho-docs - REMOTE="https://x-access-token:${DOCS_TOKEN}@github.com/AnsoCode/sencho-docs.git" + REMOTE="https://x-access-token:${DOCS_TOKEN}@github.com/studio-saelix/sencho-docs.git" if git clone "${REMOTE}" sencho-docs 2>/dev/null; then echo "Cloned existing sencho-docs." diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index 1d82fa28..ff5995cf 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -24,6 +24,6 @@ jobs: # PERSONAL_ACCESS_TOKEN: ${{ secrets.PERSONAL_ACCESS_TOKEN }} with: path-to-signatures: 'signatures/version1/cla.json' - path-to-document: 'https://github.com/AnsoCode/Sencho/blob/main/CLA.md' + path-to-document: 'https://github.com/studio-saelix/sencho/blob/main/CLA.md' branch: 'main' allowlist: 'dependabot[bot],greenkeeper[bot],github-actions[bot],release-please[bot],sencho-quartermaster[bot]' diff --git a/.github/workflows/docker-publish.yml b/.github/workflows/docker-publish.yml index 4eb7c561..b3730ab5 100644 --- a/.github/workflows/docker-publish.yml +++ b/.github/workflows/docker-publish.yml @@ -170,7 +170,7 @@ jobs: # Signs every tag produced by metadata-action using the ambient GitHub # OIDC token. No private keys, no secrets. Users verify with: # cosign verify saelix/sencho: \ - # --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \ + # --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \ # --certificate-oidc-issuer https://token.actions.githubusercontent.com # Each ref is pinned to the immutable digest so signatures are bound to # the exact manifest, not the mutable tag pointer. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 0e481ada..50c3d832 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -80,7 +80,7 @@ Before writing code for a new gated feature, please open an issue to discuss it ## Reporting Bugs -Use the [bug report template](https://github.com/AnsoCode/Sencho/issues/new?template=bug_report.yml). Include: deployment method, Sencho version, browser (for UI issues), steps to reproduce, and expected vs actual behavior. +Use the [bug report template](https://github.com/studio-saelix/sencho/issues/new?template=bug_report.yml). Include: deployment method, Sencho version, browser (for UI issues), steps to reproduce, and expected vs actual behavior. ## Code Style diff --git a/SECURITY.md b/SECURITY.md index c68871fd..ed185106 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -16,7 +16,7 @@ Sencho is self-hosted software. Always run the latest release to receive securit You can report security issues in two ways: 1. **Email:** Send details to **security@sencho.io** -2. **GitHub:** Use [private vulnerability reporting](https://github.com/AnsoCode/Sencho/security/advisories/new) in the Security tab +2. **GitHub:** Use [private vulnerability reporting](https://github.com/studio-saelix/sencho/security/advisories/new) in the Security tab In your report, include: steps to reproduce, impact assessment, and any suggested fixes. @@ -40,7 +40,7 @@ Quick summary: ```bash # Verify image signature (cosign keyless, Rekor logged) cosign verify saelix/sencho: \ - --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \ + --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com # Scan with VEX applied (zero unresolved HIGH/CRITICAL CVEs) diff --git a/backend/src/utils/version-check.ts b/backend/src/utils/version-check.ts index 3da421fb..af881155 100644 --- a/backend/src/utils/version-check.ts +++ b/backend/src/utils/version-check.ts @@ -8,7 +8,7 @@ import { CacheService } from '../services/CacheService'; */ async function fetchFromGitHub(): Promise { - const res = await fetch('https://api.github.com/repos/AnsoCode/Sencho/releases/latest', { + const res = await fetch('https://api.github.com/repos/studio-saelix/sencho/releases/latest', { headers: { Accept: 'application/vnd.github+json', 'User-Agent': 'Sencho' }, signal: AbortSignal.timeout(10000), }); diff --git a/docs/docs.json b/docs/docs.json index 80cbc625..2b10b5e2 100644 --- a/docs/docs.json +++ b/docs/docs.json @@ -29,7 +29,7 @@ "links": [ { "type": "github", - "href": "https://github.com/AnsoCode/Sencho" + "href": "https://github.com/studio-saelix/sencho" } ], "primary": { @@ -40,7 +40,7 @@ }, "footer": { "socials": { - "github": "https://github.com/AnsoCode/Sencho" + "github": "https://github.com/studio-saelix/sencho" }, "links": [ { @@ -48,14 +48,14 @@ "items": [ { "label": "Website", "href": "https://sencho.io" }, { "label": "Pricing", "href": "https://sencho.io/#pricing" }, - { "label": "Changelog", "href": "https://github.com/AnsoCode/Sencho/releases" } + { "label": "Changelog", "href": "https://github.com/studio-saelix/sencho/releases" } ] }, { "header": "Community", "items": [ - { "label": "GitHub", "href": "https://github.com/AnsoCode/Sencho" }, - { "label": "Contributing", "href": "https://github.com/AnsoCode/Sencho/blob/main/CONTRIBUTING.md" } + { "label": "GitHub", "href": "https://github.com/studio-saelix/sencho" }, + { "label": "Contributing", "href": "https://github.com/studio-saelix/sencho/blob/main/CONTRIBUTING.md" } ] }, { diff --git a/docs/openapi.yaml b/docs/openapi.yaml index 220091c3..a49ce759 100644 --- a/docs/openapi.yaml +++ b/docs/openapi.yaml @@ -32,7 +32,7 @@ info: url: https://sencho.io license: name: BSL 1.1 - url: https://github.com/AnsoCode/Sencho/blob/main/LICENSE + url: https://github.com/studio-saelix/sencho/blob/main/LICENSE servers: - url: "{protocol}://{host}:{port}" diff --git a/docs/operations/upgrade.mdx b/docs/operations/upgrade.mdx index 15494c1b..69adebc3 100644 --- a/docs/operations/upgrade.mdx +++ b/docs/operations/upgrade.mdx @@ -65,7 +65,7 @@ If you prefer to control exactly which version you run, pin the image tag in you image: saelix/sencho:0.38.0 ``` -Check [GitHub Releases](https://github.com/AnsoCode/Sencho/releases) for available versions and changelogs. +Check [GitHub Releases](https://github.com/studio-saelix/sencho/releases) for available versions and changelogs. --- @@ -83,4 +83,4 @@ Sencho follows [Semantic Versioning](https://semver.org/) (`MAJOR.MINOR.PATCH`): While the version is below 1.0, minor releases (0.x.0) may occasionally include breaking changes. These are always documented in the release notes. Once Sencho reaches 1.0, breaking changes will only occur in major releases. -Breaking changes are marked with `BREAKING CHANGE` in the [release notes](https://github.com/AnsoCode/Sencho/releases). Subscribe to the repository's releases to be notified of new versions. +Breaking changes are marked with `BREAKING CHANGE` in the [release notes](https://github.com/studio-saelix/sencho/releases). Subscribe to the repository's releases to be notified of new versions. diff --git a/docs/operations/verifying-images.mdx b/docs/operations/verifying-images.mdx index 076ba626..526855de 100644 --- a/docs/operations/verifying-images.mdx +++ b/docs/operations/verifying-images.mdx @@ -29,7 +29,7 @@ Every published tag is signed with cosign keyless signing via GitHub Actions OID ```bash cosign verify saelix/sencho: \ - --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \ + --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com ``` @@ -46,7 +46,7 @@ BuildKit produces an SLSA v1 provenance attestation during every multi-arch buil ```bash cosign verify-attestation \ --type slsaprovenance \ - --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \ + --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ saelix/sencho: | jq -r '.payload' | base64 -d | jq ``` @@ -56,7 +56,7 @@ cosign verify-attestation \ ```bash cosign verify-attestation \ --type cyclonedx \ - --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \ + --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ saelix/sencho: | jq -r '.payload' | base64 -d | jq ``` @@ -68,7 +68,7 @@ Alternatively, download `sbom.cdx.json` directly from the GitHub Release assets ```bash cosign verify-attestation \ --type spdxjson \ - --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \ + --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ saelix/sencho: | jq -r '.payload' | base64 -d | jq ``` @@ -82,7 +82,7 @@ The OpenVEX document explains Sencho's triage decisions for any CVEs that appear ```bash cosign verify-attestation \ --type openvex \ - --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \ + --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com \ saelix/sencho: | jq -r '.payload' | base64 -d | jq ``` @@ -96,7 +96,7 @@ To reproduce the same scan that gates every release: ```bash # Download the VEX document curl -Lo sencho.openvex.json \ - https://github.com/AnsoCode/Sencho/releases/latest/download/sencho.openvex.json + https://github.com/studio-saelix/sencho/releases/latest/download/sencho.openvex.json # Scan with VEX applied (exit 1 if any unresolved HIGH/CRITICAL CVE) trivy image \ diff --git a/docs/reference/contact.mdx b/docs/reference/contact.mdx index 108acf76..55fed207 100644 --- a/docs/reference/contact.mdx +++ b/docs/reference/contact.mdx @@ -11,7 +11,7 @@ Sencho provides dedicated email channels for different types of inquiries. Use t Technical support, how-to questions, and troubleshooting help. Available to Skipper and Admiral license holders via **Settings > Help & Support** in the app. -Community users can get help through the [Documentation](https://docs.sencho.io) and [GitHub Issues](https://github.com/AnsoCode/Sencho/issues). +Community users can get help through the [Documentation](https://docs.sencho.io) and [GitHub Issues](https://github.com/studio-saelix/sencho/issues). ## General inquiries @@ -26,7 +26,7 @@ Community users can get help through the [Documentation](https://docs.sencho.io) This address appears in: -- The [LICENSE](https://github.com/AnsoCode/Sencho/blob/main/LICENSE) file for alternative licensing inquiries +- The [LICENSE](https://github.com/studio-saelix/sencho/blob/main/LICENSE) file for alternative licensing inquiries - Upgrade prompts inside the app (paywall screens) - The [Refund Policy](https://sencho.io/refund) and pricing section on the website @@ -36,9 +36,9 @@ This address appears in: Vulnerability reports, security incidents, and bug bounty submissions. **Do not open a public issue for security vulnerabilities.** -You can also use [GitHub private vulnerability reporting](https://github.com/AnsoCode/Sencho/security/advisories/new). Both the app and the website publish a `/.well-known/security.txt` file that points to this address. +You can also use [GitHub private vulnerability reporting](https://github.com/studio-saelix/sencho/security/advisories/new). Both the app and the website publish a `/.well-known/security.txt` file that points to this address. -See the full [Security Policy](https://github.com/AnsoCode/Sencho/blob/main/SECURITY.md) for response times and disclosure guidelines. +See the full [Security Policy](https://github.com/studio-saelix/sencho/blob/main/SECURITY.md) for response times and disclosure guidelines. ## Privacy @@ -54,7 +54,7 @@ This address is listed in the [Privacy Policy](https://sencho.io/privacy) and [T Reports of Code of Conduct violations in any Sencho community space. -All reports are reviewed promptly and handled with confidentiality. See the [Code of Conduct](https://github.com/AnsoCode/Sencho/blob/main/CODE_OF_CONDUCT.md) for details. +All reports are reviewed promptly and handled with confidentiality. See the [Code of Conduct](https://github.com/studio-saelix/sencho/blob/main/CODE_OF_CONDUCT.md) for details. ## Summary diff --git a/docs/reference/security-advisories.mdx b/docs/reference/security-advisories.mdx index ad4e8e69..8d0898cf 100644 --- a/docs/reference/security-advisories.mdx +++ b/docs/reference/security-advisories.mdx @@ -59,5 +59,5 @@ The following dependency upgrades resolved all known CVEs at time of release: Sencho tracks and remediates dependency CVEs with each release. Dependency versions are pinned in the Dockerfile for reproducible builds and targeted remediation independent of Alpine's release cycle. - If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/AnsoCode/Sencho/releases) where each release documents dependency changes. + If you need specific CVE details for compliance or audit purposes, refer to the [GitHub release notes](https://github.com/studio-saelix/sencho/releases) where each release documents dependency changes. diff --git a/docs/reference/verifying-images.mdx b/docs/reference/verifying-images.mdx index ab000e52..e55c2678 100644 --- a/docs/reference/verifying-images.mdx +++ b/docs/reference/verifying-images.mdx @@ -15,7 +15,7 @@ Every image also ships with an embedded SBOM (Software Bill of Materials) and [S Verification guarantees: -1. The image was built from the [AnsoCode/Sencho](https://github.com/AnsoCode/Sencho) repository on GitHub. +1. The image was built from the [studio-saelix/sencho](https://github.com/studio-saelix/sencho) repository on GitHub. 2. The build ran inside a GitHub Actions workflow, not on someone's laptop. 3. The image has not been tampered with between publish and pull. @@ -51,10 +51,15 @@ Replace `` with the version you intend to pull, for example `0.42.7`, `0.42 ```bash cosign verify saelix/sencho: \ - --certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \ + --certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \ --certificate-oidc-issuer https://token.actions.githubusercontent.com ``` + + Images released before the repository migration (prior to v0.65.x) were signed with the identity `https://github.com/AnsoCode/Sencho/...`. To verify those older images, use the combined regexp: + `"https://github.com/(AnsoCode/Sencho|studio-saelix/sencho)/.*"` + + A successful verification prints the signature, the Rekor transparency log entry, and the certificate that signed it. If the image is not signed by the official Sencho pipeline, the command exits with a non-zero status and you should not run that image. ## Inspect the SBOM and provenance diff --git a/docs/security.mdx b/docs/security.mdx index f5858edf..a8b111bd 100644 --- a/docs/security.mdx +++ b/docs/security.mdx @@ -260,6 +260,6 @@ For copy-paste verification commands, see [Verifying Images](/operations/verifyi ## Reporting a vulnerability -If you discover a security vulnerability in Sencho, please report it privately via [security@sencho.io](mailto:security@sencho.io) or through [GitHub private vulnerability reporting](https://github.com/AnsoCode/Sencho/security/advisories/new). Do not open a public issue for security vulnerabilities. +If you discover a security vulnerability in Sencho, please report it privately via [security@sencho.io](mailto:security@sencho.io) or through [GitHub private vulnerability reporting](https://github.com/studio-saelix/sencho/security/advisories/new). Do not open a public issue for security vulnerabilities. -See the full [Security Policy](https://github.com/AnsoCode/Sencho/blob/main/SECURITY.md) for response times and disclosure guidelines. +See the full [Security Policy](https://github.com/studio-saelix/sencho/blob/main/SECURITY.md) for response times and disclosure guidelines. diff --git a/frontend/public/.well-known/security.txt b/frontend/public/.well-known/security.txt index e6fa36d1..9d6fa250 100644 --- a/frontend/public/.well-known/security.txt +++ b/frontend/public/.well-known/security.txt @@ -1,6 +1,6 @@ Contact: mailto:security@sencho.io -Contact: https://github.com/AnsoCode/Sencho/security/advisories/new +Contact: https://github.com/studio-saelix/sencho/security/advisories/new Expires: 2027-12-31T23:59:00.000Z Preferred-Languages: en Canonical: https://sencho.io/.well-known/security.txt -Policy: https://github.com/AnsoCode/Sencho/blob/main/SECURITY.md +Policy: https://github.com/studio-saelix/sencho/blob/main/SECURITY.md diff --git a/frontend/src/components/UserProfileDropdown.tsx b/frontend/src/components/UserProfileDropdown.tsx index a4bd24d4..6f9e2780 100644 --- a/frontend/src/components/UserProfileDropdown.tsx +++ b/frontend/src/components/UserProfileDropdown.tsx @@ -151,7 +151,7 @@ export function UserProfileDropdown({ theme, setTheme, onOpenSettings }: UserPro diff --git a/frontend/src/components/settings/AboutSection.tsx b/frontend/src/components/settings/AboutSection.tsx index 77b419e4..6e770944 100644 --- a/frontend/src/components/settings/AboutSection.tsx +++ b/frontend/src/components/settings/AboutSection.tsx @@ -32,7 +32,7 @@ export function AboutSection() {

Links

-
diff --git a/package.json b/package.json index 20e1c60d..f51f0b8f 100644 --- a/package.json +++ b/package.json @@ -1,7 +1,7 @@ { "name": "sencho", "version": "0.65.0", - "description": "", + "description": "Self-hosted Docker control plane for Compose with atomic deployments, self-healing, and fleet-wide automation.", "main": "index.js", "scripts": { "test": "cd backend && npm test", @@ -10,18 +10,18 @@ }, "repository": { "type": "git", - "url": "git+https://github.com/AnsoCode/Sencho.git" + "url": "git+https://github.com/studio-saelix/sencho.git" }, "keywords": [], - "author": "", + "author": "Studio Saelix", "license": "SEE LICENSE IN LICENSE", "type": "commonjs", "bugs": { - "url": "https://github.com/AnsoCode/Sencho/issues" + "url": "https://github.com/studio-saelix/sencho/issues" }, - "homepage": "https://github.com/AnsoCode/Sencho#readme", + "homepage": "https://github.com/studio-saelix/sencho#readme", "devDependencies": { "@playwright/test": "^1.59.1", "otplib": "^13.4.0" } -} +} \ No newline at end of file diff --git a/security/vex/sencho.openvex.json b/security/vex/sencho.openvex.json index beebfbf6..e206cb5b 100644 --- a/security/vex/sencho.openvex.json +++ b/security/vex/sencho.openvex.json @@ -1,6 +1,6 @@ { "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://github.com/AnsoCode/Sencho/security/vex/sencho.openvex.json", + "@id": "https://github.com/studio-saelix/sencho/security/vex/sencho.openvex.json", "author": "Studio Saelix", "role": "Vendor", "timestamp": "2026-04-29T00:00:00Z",