Point setup action at Astrid Runtime

.github/workflows/test.yml

@@ -16,7 +16,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, macos-13]
+        os: [ubuntu-latest, ubuntu-24.04-arm, macos-latest, macos-15-intel]
     runs-on: ${{ matrix.os }}
     steps:
       - uses: actions/checkout@v4

README.md

@@ -1,6 +1,6 @@
 # setup-astrid
 
-A GitHub Action that installs the [Astrid](https://github.com/unicity-astrid/astrid) CLI
+A GitHub Action that installs the [Astrid](https://github.com/astrid-runtime/astrid) CLI
 (`astrid`, `astrid-daemon`, `astrid-build`, `astrid-emit`) onto a CI runner and puts it on
 `PATH` — so a later step can run `astrid capsule check`, build a capsule, or anything else,
 in one line.
@@ -13,14 +13,14 @@ release workflow's identity), and the downloaded archive is checked against thos
 ## Usage
 
 ```yaml
-- uses: unicity-astrid/setup-astrid@v1
+- uses: astrid-runtime/setup-astrid@v2
 - run: astrid capsule check
 ```
 
 Pin a version and run a full capsule build:
 
 ```yaml
-- uses: unicity-astrid/setup-astrid@v1
+- uses: astrid-runtime/setup-astrid@v2
   with:
     version: "0.9.2"
 - run: astrid build
@@ -36,7 +36,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: unicity-astrid/setup-astrid@v1
+      - uses: astrid-runtime/setup-astrid@v2
       - run: astrid capsule check      # non-zero exit fails the job
 ```
 
@@ -45,9 +45,14 @@ jobs:
 | Input | Default | Description |
 |-------|---------|-------------|
 | `version` | `latest` | Astrid version to install (e.g. `0.9.2`), or `latest`. |
-| `repository` | `unicity-astrid/astrid` | Owner/repo to install the release from (override for a fork or mirror). |
+| `repository` | `astrid-runtime/astrid` | Owner/repo to install the release from (override for a fork, mirror, or historical Astrid release). |
 | `verify` | `sigstore` | `sigstore` (cosign provenance + integrity), `checksum` (SHA256 integrity only, no extra tooling), or `none` (not recommended). |
 | `certificate-identity` | *(derived)* | Advanced: override the expected cosign certificate identity. Defaults to the `release.yml` workflow of `repository` at the version tag. |
+
+Historical Astrid releases published before the organization transfer retain the
+`unicity-astrid/astrid` Sigstore workflow identity. The default Astrid Runtime
+repository automatically retries that historical identity when needed. Forks and an
+explicit `certificate-identity` override still require an exact identity match.
 | `github-token` | `${{ github.token }}` | Token for the release lookup and asset downloads. |
 
 ## Outputs

action.yml

@@ -1,6 +1,6 @@
 name: "Setup Astrid"
 description: "Install the Astrid CLI (astrid, astrid-daemon, astrid-build, astrid-emit) into a CI runner, with sigstore provenance / SHA256 verification."
-author: "Unicity Labs"
+author: "Astrid contributors"
 branding:
   icon: "box"
   color: "purple"
@@ -13,7 +13,7 @@ inputs:
   repository:
     description: "GitHub owner/repo to install the release from (override for a fork or a mirror)."
     required: false
-    default: "unicity-astrid/astrid"
+    default: "astrid-runtime/astrid"
   verify:
     description: >-
       Artifact verification mode: 'sigstore' (cosign — verifies the release's
@@ -148,15 +148,31 @@ runs:
             if [ -z "${identity}" ]; then
               identity="https://github.com/${REPO}/.github/workflows/release.yml@refs/tags/${TAG}"
             fi
-            echo "setup-astrid: verifying SHA256SUMS.txt provenance via cosign (identity: ${identity})"
             # Authenticity: the checksums file carries a keyless signature bound
             # to the release workflow's GitHub OIDC identity. Verify that, then
             # check the archive against the now-trusted checksums.
-            cosign verify-blob \
-              --bundle "SHA256SUMS.txt.sigstore.json" \
-              --certificate-identity "${identity}" \
-              --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
-              "SHA256SUMS.txt"
+            verify_identity() {
+              local expected="$1"
+              echo "setup-astrid: verifying SHA256SUMS.txt provenance via cosign (identity: ${expected})"
+              cosign verify-blob \
+                --bundle "SHA256SUMS.txt.sigstore.json" \
+                --certificate-identity "${expected}" \
+                --certificate-oidc-issuer "https://token.actions.githubusercontent.com" \
+                "SHA256SUMS.txt"
+            }
+
+            if ! verify_identity "${identity}"; then
+              # Releases made before the organization transfer retain their
+              # original GitHub OIDC workflow identity. Only the new canonical
+              # repository gets this narrow fallback; forks and explicit
+              # overrides must match exactly as requested.
+              if [ -n "${CERT_ID_OVERRIDE}" ] || [ "${REPO}" != "astrid-runtime/astrid" ]; then
+                exit 1
+              fi
+              legacy_identity="https://github.com/unicity-astrid/astrid/.github/workflows/release.yml@refs/tags/${TAG}"
+              echo "setup-astrid: retrying historical Astrid release identity"
+              verify_identity "${legacy_identity}"
+            fi
             verify_checksum
             ;;
           checksum)