diff --git a/.github/ISSUE_TEMPLATE/bug_report.yml b/.github/ISSUE_TEMPLATE/bug_report.yml index a3a44ad..dc08a05 100644 --- a/.github/ISSUE_TEMPLATE/bug_report.yml +++ b/.github/ISSUE_TEMPLATE/bug_report.yml @@ -6,9 +6,9 @@ body: attributes: value: | For **security vulnerabilities** do NOT use this form — see - [SECURITY.md](https://github.com/bkd-dotcom/umbra-action/security/policy). + [SECURITY.md](https://github.com/Signetry/action/security/policy). Governance-logic bugs (contract, verifier, receipts) belong in - [umbra-core](https://github.com/bkd-dotcom/umbra-core/issues). + [umbra-core](https://github.com/Signetry/core/issues). - type: input id: version attributes: diff --git a/.github/ISSUE_TEMPLATE/config.yml b/.github/ISSUE_TEMPLATE/config.yml index 3475cd4..ac04845 100644 --- a/.github/ISSUE_TEMPLATE/config.yml +++ b/.github/ISSUE_TEMPLATE/config.yml @@ -1,8 +1,8 @@ blank_issues_enabled: true contact_links: - name: Report a security vulnerability (private) - url: https://github.com/bkd-dotcom/umbra-action/security/advisories/new + url: https://github.com/Signetry/action/security/advisories/new about: Please report vulnerabilities privately — do not open a public issue. - name: Governance logic (umbra-core) - url: https://github.com/bkd-dotcom/umbra-core/issues + url: https://github.com/Signetry/core/issues about: Bugs in the contract, verifier, receipts, or pipeline belong in umbra-core. diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index d851fd9..36ba621 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -45,10 +45,10 @@ jobs: GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} with: path-to-signatures: "signatures/cla.json" - path-to-document: "https://github.com/bkd-dotcom/umbra-action/blob/main/CLA.md" + path-to-document: "https://github.com/Signetry/action/blob/main/CLA.md" branch: "cla-signatures" allowlist: "dependabot[bot],bkd-dotcom" - custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/bkd-dotcom/umbra-action/blob/main/CLA.md)** — Umbra is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:" + custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/action/blob/main/CLA.md)** — Umbra is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:" custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA" custom-allsigned-prcomment: "All contributors have signed the CLA. ✅" lock-pullrequest-aftermerge: false diff --git a/.github/workflows/reviewer.yml b/.github/workflows/reviewer.yml index fc20e83..e0d3f35 100644 --- a/.github/workflows/reviewer.yml +++ b/.github/workflows/reviewer.yml @@ -3,7 +3,7 @@ name: Reviewer # Advisory PR review (umbra-reviewer): surfaces architecture + security issues # and posts one recommendation comment. Advisory only — it never merges and never # fails the PR. Changes to security-sensitive surfaces (workflows, packaging) are -# escalated to a human. See https://github.com/bkd-dotcom/umbra-reviewer +# escalated to a human. See https://github.com/Signetry/reviewer on: pull_request: @@ -24,7 +24,7 @@ jobs: python-version: "3.12" - name: Install umbra-reviewer # source-available (All Rights Reserved); install from source, not PyPI. - run: pip install "umbra-reviewer @ git+https://github.com/bkd-dotcom/umbra-reviewer@v0.1.1" + run: pip install "umbra-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.1" - name: Compute the PR diff env: BASE_SHA: ${{ github.event.pull_request.base.sha }} diff --git a/CHANGELOG.md b/CHANGELOG.md index 9f52f7e..0981964 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -9,7 +9,7 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag. ### Changed -- Default `umbra-core` install pinned to `git+https://github.com/bkd-dotcom/umbra-core@v0.5.4` +- Default `umbra-core` install pinned to `git+https://github.com/Signetry/core@v0.5.4` (was `@v0.5.3`) following the umbra-core v0.5.4 source-available release. - The `umbra-version` input is documented as a **source version tag** (umbra-core is source-available and installed from its source repo, not PyPI). @@ -25,7 +25,7 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag. made under a copyright-assignment agreement). - **Installs `umbra-core` from its source repo, not PyPI** — `umbra-core` was removed from PyPI, so the Action now installs it via - `git+https://github.com/bkd-dotcom/umbra-core@v0.5.3` (default) or the tag given in + `git+https://github.com/Signetry/core@v0.5.3` (default) or the tag given in the `umbra-version` input. Fixes workflows that would otherwise fail after the PyPI removal. @@ -80,5 +80,5 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag. > `v0.1.0`–`v0.1.2` (exact pins) are superseded — upgrade to `@v1`. See > [SECURITY.md](SECURITY.md). -[0.1.3]: https://github.com/bkd-dotcom/umbra-action/releases/tag/v0.1.3 -[0.1.0]: https://github.com/bkd-dotcom/umbra-action/releases/tag/v0.1.0 +[0.1.3]: https://github.com/Signetry/action/releases/tag/v0.1.3 +[0.1.0]: https://github.com/Signetry/action/releases/tag/v0.1.0 diff --git a/CODE_OF_CONDUCT.md b/CODE_OF_CONDUCT.md index 8311a03..7d4b296 100644 --- a/CODE_OF_CONDUCT.md +++ b/CODE_OF_CONDUCT.md @@ -52,7 +52,7 @@ an individual is officially representing the community in public spaces. Instances of abusive, harassing, or otherwise unacceptable behavior may be reported to the maintainers via -[GitHub private vulnerability reporting](https://github.com/bkd-dotcom/umbra-action/security/advisories/new) +[GitHub private vulnerability reporting](https://github.com/Signetry/action/security/advisories/new) or by opening a confidential issue. All complaints will be reviewed and investigated promptly and fairly. diff --git a/MARKETPLACE.md b/MARKETPLACE.md index 367caca..f613f0a 100644 --- a/MARKETPLACE.md +++ b/MARKETPLACE.md @@ -4,7 +4,7 @@ Everything needed to publish **Umbra Admission** to the GitHub Marketplace. Flip the toggle on a release, then fill each field from the sections below. How to publish (GitHub UI): -1. Go to https://github.com/bkd-dotcom/umbra-action/releases → edit the latest +1. Go to https://github.com/Signetry/action/releases → edit the latest release (`v0.1.3` / `v1`). 2. Check **"Publish this Action to the GitHub Marketplace"**, accept the Developer Agreement. @@ -103,7 +103,7 @@ jobs: with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 - - uses: bkd-dotcom/umbra-action@v1 + - uses: Signetry/action@v1 with: min-authority: "1" # 0 observe · 1 analyze · 2 branch-PR signing-key: ${{ secrets.UMBRA_SIGNING_KEY }} # optional: stable signed receipts @@ -126,7 +126,7 @@ required_checks: ``` Without one, a conservative default applies. Full docs and the Python package -at **https://github.com/bkd-dotcom/umbra-core** (installed automatically from source; not on PyPI). +at **https://github.com/Signetry/core** (installed automatically from source; not on PyPI). #### Inputs diff --git a/README.md b/README.md index f89e06d..49a1d7e 100644 --- a/README.md +++ b/README.md @@ -6,12 +6,12 @@ [![GitHub Marketplace](https://img.shields.io/badge/Marketplace-Umbra%20Admission-purple?logo=github)](https://github.com/marketplace/actions/umbra-admission) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md) -[![Latest release](https://img.shields.io/github/v/release/bkd-dotcom/umbra-action?sort=semver)](https://github.com/bkd-dotcom/umbra-action/releases) +[![Latest release](https://img.shields.io/github/v/release/Signetry/action?sort=semver)](https://github.com/Signetry/action/releases) **Govern any coding agent's change to your repository, and attach a signed receipt.** Every pull request — no matter which agent opened it (Claude Code, Codex, Cursor, -Copilot, Devin, or a human) — is run through the [umbra-core](https://github.com/bkd-dotcom/umbra-core) +Copilot, Devin, or a human) — is run through the [umbra-core](https://github.com/Signetry/core) admission pipeline: ``` @@ -41,7 +41,7 @@ jobs: with: ref: ${{ github.event.pull_request.head.sha }} fetch-depth: 0 # base must be reachable for the diff - - uses: bkd-dotcom/umbra-action@v1 + - uses: Signetry/action@v1 with: min-authority: "1" # 0 observe · 1 analyze · 2 branch-PR signing-key: ${{ secrets.UMBRA_SIGNING_KEY }} # optional: stable signed receipts @@ -49,7 +49,7 @@ jobs: Add a `.umbra/admission.yaml` to your repo to declare the contract (allowed and forbidden paths, diff budget, required checks). Without one, a conservative -default applies. See the [umbra-core docs](https://github.com/bkd-dotcom/umbra-core). +default applies. See the [umbra-core docs](https://github.com/Signetry/core). ### Also scan for vulnerabilities (SARIF → code scanning) @@ -68,7 +68,7 @@ jobs: steps: - uses: actions/checkout@v5 with: { ref: ${{ github.event.pull_request.head.sha }}, fetch-depth: 0 } - - uses: bkd-dotcom/umbra-action@v1 + - uses: Signetry/action@v1 with: scan: "true" scan-fail-on: "high" # optional: fail the check on high+ findings @@ -108,9 +108,9 @@ authority. On Linux runners it installs bubblewrap so required checks run under real filesystem/network **sandbox** (the tier is recorded truthfully in every receipt; it falls back to a lower tier only if the sandbox can't initialize). The governance logic, contract, verifier, and receipts all live in -[umbra-core](https://github.com/bkd-dotcom/umbra-core). +[umbra-core](https://github.com/Signetry/core). -Part of the [Umbra platform](https://github.com/bkd-dotcom/umbra-umbrella) — see the umbrella for the full integration catalog and compatibility matrix. +Part of the [Umbra platform](https://github.com/Signetry/signetry) — see the umbrella for the full integration catalog and compatibility matrix. ## License diff --git a/SECURITY.md b/SECURITY.md index 9216c52..8eb7f0b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -19,9 +19,9 @@ fixed in `v0.1.3`. If you pinned an exact old tag, move to `@v1`. ## Reporting a vulnerability Do **not** open a public issue. Use private reporting: -**https://github.com/bkd-dotcom/umbra-action/security/advisories/new** +**https://github.com/Signetry/action/security/advisories/new** (or report core issues at -https://github.com/bkd-dotcom/umbra-core/security/advisories/new). +https://github.com/Signetry/core/security/advisories/new). ## Safe usage diff --git a/action.yml b/action.yml index b52a9da..0029172 100644 --- a/action.yml +++ b/action.yml @@ -102,13 +102,13 @@ runs: *[!0-9.a-zA-Z_-]*) echo "::error::Invalid umbra-version '$VER'"; exit 1 ;; esac # Install the pinned tag from the source repository. - pip install "umbra-core @ git+https://github.com/bkd-dotcom/umbra-core@v$VER" + pip install "umbra-core @ git+https://github.com/Signetry/core@v$VER" else # umbra-core is distributed from its source repository (All Rights Reserved; # not published to PyPI). Install the latest release tag. 0.5.0+ carries the # capability graph, G1/G2/G3 gates, the `umbra comment` renderer, and the # SAST detection engine (needed for `scan: true`). - pip install "umbra-core @ git+https://github.com/bkd-dotcom/umbra-core@v0.5.4" + pip install "umbra-core @ git+https://github.com/Signetry/core@v0.5.4" fi - name: Detection scan (optional)