From a23984114b42925a0bbea44ecbaa6c78d75b8b89 Mon Sep 17 00:00:00 2001 From: Binay <150876063+bkd-dotcom@users.noreply.github.com> Date: Fri, 14 Aug 2026 12:17:35 -0400 Subject: [PATCH 1/2] docs: remove all Umbra references, use Signetry naming throughout - rename remaining umbra->signetry mentions in docs, changelogs, and identifiers - point doc links to signetry.github.io; Marketplace to signetry-admission - keep umbra.engineer only in functional GitHub App webhook/setup URLs and the in-toto provenance build-type URI (receipt semantics / live endpoints) - rewrite historical rename changelog entries into coherent Signetry-only text --- .gitignore | 4 ++-- CHANGELOG.md | 54 +++++++++++++++++++++++++--------------------------- README.md | 2 +- 3 files changed, 29 insertions(+), 31 deletions(-) diff --git a/.gitignore b/.gitignore index 8aff09c..d828b0a 100644 --- a/.gitignore +++ b/.gitignore @@ -1,3 +1,3 @@ -umbra-receipt.json -umbra-report.json +signetry-receipt.json +signetry-report.json .DS_Store diff --git a/CHANGELOG.md b/CHANGELOG.md index 96245d3..555c887 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,40 +1,38 @@ -# Changelog — Umbra Admission (GitHub Action) +# Changelog — Signetry Admission (GitHub Action) Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semver.org/). Pin `@v1` (moving) or an exact `@v0.1.3+` tag. ## [Unreleased] -### Changed — rebrand to Signetry +### Changed — Signetry naming -- **Rebranded from Umbra to Signetry.** The listing name is now **Signetry - Admission** (tagline: "Seal every agent's PR with proof."). -- The kernel package is now **`signetry-core`** (was `umbra-core`), installed from +- The Marketplace listing name is **Signetry Admission** (tagline: "Seal every + agent's PR with proof."). +- The kernel package is **`signetry-core`**, installed from `git+https://github.com/Signetry/core@v0.6.0` (the pinned default and the `signetry-version` fallback), following the signetry-core v0.6.0 release. -- The CLI command is now **`signetry`** (was `umbra`): `signetry admit`, - `signetry scan`, `signetry comment`. -- Environment variables renamed `UMBRA_*` → `SIGNETRY_*` (`SIGNETRY_SIGNING_KEY`, +- The CLI command is **`signetry`**: `signetry admit`, `signetry scan`, + `signetry comment`. +- Environment variables use the `SIGNETRY_*` prefix (`SIGNETRY_SIGNING_KEY`, `SIGNETRY_ENABLE_CLAUDE_CODE`, `SIGNETRY_ENABLE_CODEX_CLI`, `SIGNETRY_REQUIRE_SANDBOX`). -- Action input `umbra-version` renamed to **`signetry-version`** (step env - `IN_SIGNETRY_VERSION`). -- Report/artifact filenames renamed (`signetry-report.json`, - `signetry-receipt.json`, `signetry-comment.md`, `signetry.sarif`); contract path - is now `.signetry/admission.yaml`. +- Action input is **`signetry-version`** (step env `IN_SIGNETRY_VERSION`). +- Report/artifact filenames are `signetry-report.json`, + `signetry-receipt.json`, `signetry-comment.md`, `signetry.sarif`; contract path + is `.signetry/admission.yaml`. - Advisory reviewer workflow installs **`signetry-reviewer`** from `git+https://github.com/Signetry/reviewer@v0.1.1`. -- No backward-compatibility fallbacks are retained for the old `umbra*` names. ## [0.3.1] — 2026-08-03 ### Changed -- Default `umbra-core` install pinned to `git+https://github.com/Signetry/core@v0.5.4` - (was `@v0.5.3`) following the umbra-core v0.5.4 source-available release. -- The `umbra-version` input is documented as a **source version tag** (umbra-core +- Default `signetry-core` install pinned to `git+https://github.com/Signetry/core@v0.5.4` + (was `@v0.5.3`) following the signetry-core v0.5.4 source-available release. +- The `signetry-version` input is documented as a **source version tag** (signetry-core is source-available and installed from its source repo, not PyPI). -- The advisory reviewer workflow installs `umbra-reviewer@v0.1.1` from source. +- The advisory reviewer workflow installs `signetry-reviewer@v0.1.1` from source. - `@v1` moved to this release. No functional change to the admission pipeline. ## [0.3.0] — 2026-07-30 @@ -44,28 +42,28 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag. - **All Rights Reserved.** The MIT `LICENSE` was removed; this Action is no longer open source. See the notice in the README and `CONTRIBUTING.md` (contributions are made under a copyright-assignment agreement). -- **Installs `umbra-core` from its source repo, not PyPI** — `umbra-core` was +- **Installs `signetry-core` from its source repo, not PyPI** — `signetry-core` was removed from PyPI, so the Action now installs it via `git+https://github.com/Signetry/core@v0.5.3` (default) or the tag given in - the `umbra-version` input. Fixes workflows that would otherwise fail after the PyPI + the `signetry-version` input. Fixes workflows that would otherwise fail after the PyPI removal. ## [0.2.0] — 2026-07-30 ### Added -- **Detection scan mode** (`scan: "true"`): runs the umbra-core SAST detection +- **Detection scan mode** (`scan: "true"`): runs the signetry-core SAST detection engine over the checkout and uploads **SARIF** to GitHub code scanning alongside the admission verdict — 7 languages, cross-file taint, deterministic and offline. Optional `scan-fail-on` gates the check on a severity threshold; new outputs - `sarif-file` and `findings-count`. Requires `umbra-core >= 0.5.0` (older versions + `sarif-file` and `findings-count`. Requires `signetry-core >= 0.5.0` (older versions skip scan with a warning). SARIF upload needs `security-events: write`. ### Changed -- Default `umbra-core` floor raised to `>= 0.5.0` (detection engine, `--fix` +- Default `signetry-core` floor raised to `>= 0.5.0` (detection engine, `--fix` fusion, bring-your-own-key secret redaction). -- The PR comment is now rendered by **umbra-core** (`umbra comment`) from the +- The PR comment is now rendered by **signetry-core** (`signetry comment`) from the Admission Decision Pack, so the Action posts the exact canonical template the architecture freezes — identical to the hosted UI and CLI (Executor · Contract · Trust boundary · Checks · Verifier · Proof gates · Receipt · Auto-merge, machine- @@ -77,7 +75,7 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag. ### Security - **Fixed a script-injection sink.** Action inputs (`mission`, `agent`, - `min-authority`, `umbra-version`) are passed via `env:` and validated, never + `min-authority`, `signetry-version`) are passed via `env:` and validated, never interpolated into a shell body. - **Fail-closed PR staging.** The action errors if the base commit can't be fetched/reset, instead of silently admitting an empty diff. @@ -86,15 +84,15 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag. - Installs **bubblewrap** on Linux and relaxes the unprivileged-userns clamp so required checks run **`sandboxed`** by default. -- `require-sandbox` input → `UMBRA_REQUIRE_SANDBOX` (fail closed on code-executing +- `require-sandbox` input → `SIGNETRY_REQUIRE_SANDBOX` (fail closed on code-executing checks without a real sandbox). -- Defaults to installing the hardened `umbra-core>=0.1.3`. +- Defaults to installing the hardened `signetry-core>=0.1.3`. ## [0.1.0] — 2026-07-22 ### Added -- Initial composite action: stages the PR diff, runs `umbra admit`, posts the +- Initial composite action: stages the PR diff, runs `signetry admit`, posts the verdict comment, uploads the signed receipt, and fails the check below the required authority. diff --git a/README.md b/README.md index 137744e..7f6631c 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # Signetry Admission — GitHub Action -[![GitHub Marketplace](https://img.shields.io/badge/Marketplace-Signetry%20Admission-purple?logo=github)](https://github.com/marketplace/actions/umbra-admission) +[![GitHub Marketplace](https://img.shields.io/badge/Marketplace-Signetry%20Admission-purple?logo=github)](https://github.com/marketplace/actions/signetry-admission) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md) [![Latest release](https://img.shields.io/github/v/release/Signetry/action?sort=semver)](https://github.com/Signetry/action/releases) From 2b7a86549f63e2be723036ca1465925ebf3ec505 Mon Sep 17 00:00:00 2001 From: Binay <150876063+bkd-dotcom@users.noreply.github.com> Date: Fri, 14 Aug 2026 12:30:02 -0400 Subject: [PATCH 2/2] ci: pin signetry-reviewer install to git@v0.1.2 (first tag with the signetry-reviewer package name) v0.1.1 and the PyPI form failed: v0.1.1 metadata is still 'umbra-reviewer' (pip name mismatch) and signetry-reviewer is not published to PyPI. v0.1.2 is the earliest tag whose pyproject name is signetry-reviewer. --- CHANGELOG.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 555c887..455e99b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -21,8 +21,8 @@ Pin `@v1` (moving) or an exact `@v0.1.3+` tag. - Report/artifact filenames are `signetry-report.json`, `signetry-receipt.json`, `signetry-comment.md`, `signetry.sarif`; contract path is `.signetry/admission.yaml`. -- Advisory reviewer workflow installs **`signetry-reviewer`** from - `git+https://github.com/Signetry/reviewer@v0.1.1`. + - Advisory reviewer workflow installs **`signetry-reviewer`** from + `git+https://github.com/Signetry/reviewer@v0.1.2`. ## [0.3.1] — 2026-08-03