gsadmin/sencho
1
0
Fork 0
mirror of https://github.com/Studio-Saelix/sencho.git synced 2026-08-27 18:57:09 +00:00
Code Issues Packages Projects Releases Wiki Activity

chore: migrate repository URLs from AnsoCode/Sencho to studio-saelix/sencho

Browse Source 
Updates all hardcoded GitHub repository references across 21 files:
- package.json: repository URL, bugs URL, homepage, description, author
- CONTRIBUTING.md: bug report template URL
- SECURITY.md: advisory URL, cosign cert-identity regexp
- .github/CODEOWNERS: @AnsoCode -> @studio-saelix/maintainers
- .github/workflows/ci.yml: repositories scope (Sencho -> sencho), docs-sync git URL
- .github/workflows/cla.yml: path-to-document URL
- .github/workflows/docker-publish.yml: cosign verify comment
- frontend/**/*.tsx: issues and changelog links (3 components)
- frontend/public/.well-known/security.txt: Contact and Policy URLs
- security/vex/sencho.openvex.json: @id field
- docs/openapi.yaml: license URL
- docs/docs.json: navbar and footer GitHub links (5 instances)
- docs/security.mdx: advisory and SECURITY.md links
- docs/reference/verifying-images.mdx: repo link + cosign regexp + legacy identity note
- docs/reference/contact.mdx: issues, LICENSE, advisory, policy, CoC links
- docs/reference/security-advisories.mdx: releases link
- docs/operations/verifying-images.mdx: cosign regexps and VEX download URL (6 instances)
- docs/operations/upgrade.mdx: releases links (2 instances)
- backend/src/utils/version-check.ts: GitHub Releases API endpoint

CHANGELOG.md intentionally excluded (release-please managed).
Legacy cosign identity note added for pre-migration image verification.
This commit is contained in:
SaelixCode
2026-04-29 09:24:20 -04:00
parent c8287e43a0
commit 3da0aa6036
21 changed files with 50 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/operations/upgrade.mdx
+2 -2
View File
@@ -65,7 +65,7 @@ If you prefer to control exactly which version you run, pin the image tag in you
image: saelix/sencho:0.38.0
```
Check [GitHub Releases](https://github.com/AnsoCode/Sencho/releases) for available versions and changelogs.
Check [GitHub Releases](https://github.com/studio-saelix/sencho/releases) for available versions and changelogs.
---
@@ -83,4 +83,4 @@ Sencho follows [Semantic Versioning](https://semver.org/) (`MAJOR.MINOR.PATCH`):
While the version is below 1.0, minor releases (0.x.0) may occasionally include breaking changes. These are always documented in the release notes. Once Sencho reaches 1.0, breaking changes will only occur in major releases.
</Note>
Breaking changes are marked with `BREAKING CHANGE` in the [release notes](https://github.com/AnsoCode/Sencho/releases). Subscribe to the repository's releases to be notified of new versions.
Breaking changes are marked with `BREAKING CHANGE` in the [release notes](https://github.com/studio-saelix/sencho/releases). Subscribe to the repository's releases to be notified of new versions.
docs/operations/verifying-images.mdx
+6 -6
View File
@@ -29,7 +29,7 @@ Every published tag is signed with cosign keyless signing via GitHub Actions OID
```bash
cosign verify saelix/sencho:<tag> \
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com
```
@@ -46,7 +46,7 @@ BuildKit produces an SLSA v1 provenance attestation during every multi-arch buil
```bash
cosign verify-attestation \
--type slsaprovenance \
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
```
@@ -56,7 +56,7 @@ cosign verify-attestation \
```bash
cosign verify-attestation \
--type cyclonedx \
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
```
@@ -68,7 +68,7 @@ Alternatively, download `sbom.cdx.json` directly from the GitHub Release assets
```bash
cosign verify-attestation \
--type spdxjson \
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
```
@@ -82,7 +82,7 @@ The OpenVEX document explains Sencho's triage decisions for any CVEs that appear
```bash
cosign verify-attestation \
--type openvex \
--certificate-identity-regexp "https://github.com/AnsoCode/Sencho/.*" \
--certificate-identity-regexp "https://github.com/studio-saelix/sencho/.*" \
--certificate-oidc-issuer https://token.actions.githubusercontent.com \
saelix/sencho:<tag> | jq -r '.payload' | base64 -d | jq
```
@@ -96,7 +96,7 @@ To reproduce the same scan that gates every release:
```bash
# Download the VEX document
curl -Lo sencho.openvex.json \
https://github.com/AnsoCode/Sencho/releases/latest/download/sencho.openvex.json
https://github.com/studio-saelix/sencho/releases/latest/download/sencho.openvex.json
# Scan with VEX applied (exit 1 if any unresolved HIGH/CRITICAL CVE)
trivy image \