diff --git a/CHANGELOG.md b/CHANGELOG.md index b2189e9..4b4d557 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,4 +1,4 @@ -# Changelog — umbra-github-app +# Changelog — signetry-github-app Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semver.org/). @@ -6,20 +6,18 @@ Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semve ### Changed -- Rebranded the platform from **Umbra** to **Signetry** across docs, the app - manifest display fields, and the reviewer workflow. CLI/package renamed - `umbra`/`umbra-core` → `signetry`/`signetry-core`, env vars `UMBRA_*` → - `SIGNETRY_*`, config `.umbra/` → `.signetry/`, and siblings `umbra-action` / - `umbra-reviewer` → `signetry-action` / `signetry-reviewer`. Install pins updated - to `signetry-core @ git+https://github.com/Signetry/core@v0.6.0` and +- Signetry naming across docs, the app manifest display fields, and the reviewer + workflow: CLI/package `signetry`/`signetry-core`, env vars `SIGNETRY_*`, config + `.signetry/`, and siblings `signetry-action` / `signetry-reviewer`. Install pins + are `signetry-core @ git+https://github.com/Signetry/core@v0.6.0` and `signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.2`. ## [0.1.0] — 2026-07-26 ### Added -- Public home for the Umbra GitHub App: `app-manifest.json` (one-click App +- Public home for the Signetry GitHub App: `app-manifest.json` (one-click App creation with correct permissions/events/URLs), `README.md`, and `SETUP.md` (operator secrets + Cloud Run provisioning). The App itself is served by the - hosted `umbra` service and governed by `umbra-core` — this repo carries no + hosted `signetry` service and governed by `signetry-core` — this repo carries no policy logic. diff --git a/README.md b/README.md index 015472d..71e4e81 100644 --- a/README.md +++ b/README.md @@ -12,13 +12,13 @@ and a link to the signed receipt. **Comment-only; Signetry never merges.** Part of the [Signetry platform](https://github.com/Signetry/signetry). Governance logic lives in [signetry-core](https://github.com/Signetry/core); -the App is served by the hosted [`umbra`](https://github.com/bkd-dotcom/umbra) +the App is served by the hosted [`signetry`](https://github.com/Signetry/core) service. This repository is the App's **public home**: its manifest, setup docs, and configuration — not a second copy of the governance pipeline. ## How it works -1. A single app-level webhook (`POST /api/github/app/webhook`, hosted by `umbra`) +1. A single app-level webhook (`POST /api/github/app/webhook`, hosted by `signetry`) receives PR events for every installation; each delivery is HMAC-verified. 2. On a reviewable PR, Signetry mints a **short-lived installation token** from the App's private key, reads the diff, runs the admission review (comment-only), and diff --git a/SECURITY.md b/SECURITY.md index 6482128..d1a6de3 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,12 +1,12 @@ # Security policy -The Signetry GitHub App is served by the hosted [`umbra`](https://github.com/bkd-dotcom/umbra) +The Signetry GitHub App is served by the hosted [`signetry`](https://github.com/Signetry/core) service and governed by [signetry-core](https://github.com/Signetry/core). This repo holds the App's manifest and setup docs only. ## Reporting -Open a private security advisory on the relevant repository (`umbra` for the hosted +Open a private security advisory on the relevant repository (`signetry` for the hosted webhook/token handling, `signetry-core` for governance), or use the umbrella contact: . Do not open a public issue for an unpatched vulnerability. diff --git a/SETUP.md b/SETUP.md index 79e0a8b..b6cb2f4 100644 --- a/SETUP.md +++ b/SETUP.md @@ -24,7 +24,7 @@ The installation token is short-lived, used read-only for the diff/clone and com Create the App under your GitHub account (this is the only step Signetry cannot do for you): 1. GitHub → **Settings → Developer settings → GitHub Apps → New GitHub App**. -2. **Name:** `Signetry Engineer` (this sets the install slug). **Homepage:** `https://umbra.engineer`. +2. **Name:** `Signetry Engineer` (this sets the install slug). **Homepage:** `https://signetry.github.io`. 3. **Webhook:** Active ✓ · **URL** `https://umbra.engineer/api/github/app/webhook` · **Secret:** a fresh random string (save it). 4. **Repository permissions:** Pull requests → **Read & write**; Contents → **Read-only**; Metadata → @@ -39,13 +39,13 @@ Create the App under your GitHub account (this is the only step Signetry cannot ```bash PROJECT=calm-photon-472423-h3 -printf %s "" | gcloud secrets create umbra-gh-app-id --data-file=- --project $PROJECT -printf %s "" | gcloud secrets create umbra-gh-app-webhook-secret --data-file=- --project $PROJECT -gcloud secrets create umbra-gh-app-key --data-file=umbra-engineer.private-key.pem --project $PROJECT +printf %s "" | gcloud secrets create signetry-gh-app-id --data-file=- --project $PROJECT +printf %s "" | gcloud secrets create signetry-gh-app-webhook-secret --data-file=- --project $PROJECT +gcloud secrets create signetry-gh-app-key --data-file=signetry-engineer.private-key.pem --project $PROJECT -gcloud run services update umbra --region us-central1 --project $PROJECT \ +gcloud run services update signetry --region us-central1 --project $PROJECT \ --update-env-vars GITHUB_APP_SLUG= \ - --update-secrets GITHUB_APP_ID=umbra-gh-app-id:latest,GITHUB_APP_WEBHOOK_SECRET=umbra-gh-app-webhook-secret:latest,GITHUB_APP_PRIVATE_KEY=umbra-gh-app-key:latest + --update-secrets GITHUB_APP_ID=signetry-gh-app-id:latest,GITHUB_APP_WEBHOOK_SECRET=signetry-gh-app-webhook-secret:latest,GITHUB_APP_PRIVATE_KEY=signetry-gh-app-key:latest ``` `GITHUB_APP_PRIVATE_KEY` accepts a raw PEM (newlines preserved by the secret mount) or base64 of the PEM. @@ -59,7 +59,7 @@ Never paste the private key or webhook secret into code, logs, or chat. an unsigned/bad-signature POST → **401**; a validly-signed `ping` → **200**. - End-to-end: install the App on a repo → open a PR → an **🌑 Signetry Review** comment appears within a few seconds; the dashboard lists the repo under "Autonomous PR auto-review". Failures are logged under the - `umbra.webhook` logger (grep Cloud Run logs). + `signetry.webhook` logger (grep Cloud Run logs). ## Local development diff --git a/app-manifest.json b/app-manifest.json index e2aca45..b0d4fd2 100644 --- a/app-manifest.json +++ b/app-manifest.json @@ -1,6 +1,6 @@ { "name": "Signetry Engineer", - "url": "https://umbra.engineer", + "url": "https://signetry.github.io", "hook_attributes": { "url": "https://umbra.engineer/api/github/app/webhook", "active": true