From 5df53502dbbd239c1255008eb0a8882866405885 Mon Sep 17 00:00:00 2001 From: Binay <150876063+bkd-dotcom@users.noreply.github.com> Date: Wed, 12 Aug 2026 14:05:29 -0400 Subject: [PATCH] rename!: adopt Signetry (formula/manifest/docs) + signetry-core@v0.6.0 Hard rename to Signetry. See report. Preserved umbra.engineer domain + hosted bkd-dotcom/umbra service infra where applicable. --- .github/workflows/cla.yml | 2 +- .github/workflows/reviewer.yml | 12 ++++++------ CHANGELOG.md | 12 ++++++++++++ CLA.md | 4 ++-- CONTRIBUTING.md | 2 +- CONTRIBUTORS.md | 2 +- README.md | 14 +++++++------- SECURITY.md | 6 +++--- SETUP.md | 14 +++++++------- app-manifest.json | 4 ++-- 10 files changed, 42 insertions(+), 30 deletions(-) diff --git a/.github/workflows/cla.yml b/.github/workflows/cla.yml index c652af4..9fe31db 100644 --- a/.github/workflows/cla.yml +++ b/.github/workflows/cla.yml @@ -48,7 +48,7 @@ jobs: path-to-document: "https://github.com/Signetry/github-app/blob/main/CLA.md" branch: "cla-signatures" allowlist: "dependabot[bot],bkd-dotcom" - custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/github-app/blob/main/CLA.md)** — Umbra is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:" + custom-notsigned-prcomment: "Thanks for your contribution! Before it can be merged, please read the **[Contributor License Agreement](https://github.com/Signetry/github-app/blob/main/CLA.md)** — Signetry is **All Rights Reserved**, and by signing you assign copyright/ownership of your contribution to the Owner (you may not use, sell, or commercialize it yourself). To agree, reply with exactly:" custom-pr-sign-comment: "I have read the CLA Document and I hereby sign the CLA" custom-allsigned-prcomment: "All contributors have signed the CLA. ✅" lock-pullrequest-aftermerge: false diff --git a/.github/workflows/reviewer.yml b/.github/workflows/reviewer.yml index 99ee6f8..f781b21 100644 --- a/.github/workflows/reviewer.yml +++ b/.github/workflows/reviewer.yml @@ -1,6 +1,6 @@ name: Reviewer -# Advisory PR review (umbra-reviewer): surfaces architecture + security issues +# Advisory PR review (signetry-reviewer): surfaces architecture + security issues # and posts one recommendation comment. Advisory only — it never merges and never # fails the PR. Changes to security-sensitive surfaces (workflows, packaging) are # escalated to a human. See https://github.com/Signetry/reviewer @@ -22,9 +22,9 @@ jobs: - uses: actions/setup-python@v7 with: python-version: "3.12" - - name: Install umbra-reviewer + - name: Install signetry-reviewer # source-available (All Rights Reserved); install from source, not PyPI. - run: pip install "umbra-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.1" + run: pip install "signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.2" - name: Compute the PR diff env: BASE_SHA: ${{ github.event.pull_request.base.sha }} @@ -40,7 +40,7 @@ jobs: PR: ${{ github.event.pull_request.number }} run: | set -uo pipefail - umbra-reviewer review \ + signetry-reviewer review \ --diff "$OUT/pr.diff" \ --repo "$GITHUB_REPOSITORY" \ --pr "$PR" \ @@ -56,9 +56,9 @@ jobs: script: | const fs = require('fs'); const path = require('path'); const out = process.env.OUT || ''; - let body = 'Umbra Reviewer: no review was produced.'; + let body = 'Signetry Reviewer: no review was produced.'; try { body = fs.readFileSync(path.join(out, 'comment.md'), 'utf8'); } catch (e) {} - const marker = ''; + const marker = ''; body = marker + '\n' + body; const { owner, repo } = context.repo; const issue_number = context.issue.number; diff --git a/CHANGELOG.md b/CHANGELOG.md index 9a70105..b2189e9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,18 @@ Follows [Keep a Changelog](https://keepachangelog.com/) / [SemVer](https://semver.org/). +## [Unreleased] + +### Changed + +- Rebranded the platform from **Umbra** to **Signetry** across docs, the app + manifest display fields, and the reviewer workflow. CLI/package renamed + `umbra`/`umbra-core` → `signetry`/`signetry-core`, env vars `UMBRA_*` → + `SIGNETRY_*`, config `.umbra/` → `.signetry/`, and siblings `umbra-action` / + `umbra-reviewer` → `signetry-action` / `signetry-reviewer`. Install pins updated + to `signetry-core @ git+https://github.com/Signetry/core@v0.6.0` and + `signetry-reviewer @ git+https://github.com/Signetry/reviewer@v0.1.2`. + ## [0.1.0] — 2026-07-26 ### Added diff --git a/CLA.md b/CLA.md index 3445793..07c0cbc 100644 --- a/CLA.md +++ b/CLA.md @@ -1,8 +1,8 @@ -# Umbra Contributor License Agreement (CLA) +# Signetry Contributor License Agreement (CLA) **Copyright (c) 2026 Binay Dalai. All rights reserved.** -Thank you for your interest in contributing to Umbra ("the Project"), owned by +Thank you for your interest in contributing to Signetry ("the Project"), owned by Binay Dalai ("the Owner"). This Contributor License Agreement ("Agreement") governs any contribution you submit. You must agree to it before your contribution can be accepted. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index f9432c1..9f91869 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -13,7 +13,7 @@ I have read the CLA Document and I hereby sign the CLA ``` Your acceptance is recorded in `signatures/cla.json`. A PR **cannot be merged** until -the CLA is signed. Umbra is **not open source** (All Rights Reserved) — by signing +the CLA is signed. Signetry is **not open source** (All Rights Reserved) — by signing you assign copyright/ownership of your contribution to the Owner and gain no right to use, sell, or commercialize it yourself. diff --git a/CONTRIBUTORS.md b/CONTRIBUTORS.md index 9f189ef..38dcd13 100644 --- a/CONTRIBUTORS.md +++ b/CONTRIBUTORS.md @@ -1,6 +1,6 @@ # Contributors -Umbra is **owned by Binay Dalai** and is **All Rights Reserved** (not open source). +Signetry is **owned by Binay Dalai** and is **All Rights Reserved** (not open source). The people below are gratefully acknowledged for contributions accepted under the [Contributor License Agreement](CLA.md). diff --git a/README.md b/README.md index 7b4dc71..015472d 100644 --- a/README.md +++ b/README.md @@ -1,17 +1,17 @@ -# umbra-github-app +# signetry-github-app > **Copyright (c) 2026 Binay Dalai. All rights reserved.** > This repository is strictly for viewing and contributing to the original project. You may not use, copy, modify, distribute, or commercialize this code for your own personal or commercial projects without explicit written permission. Only the original author retains the right to use and monetize this project. -**The Umbra GitHub App — install-once PR admission review, posted as the App.** +**The Signetry GitHub App — install-once PR admission review, posted as the App.** Install once on an account or org (pick repos in GitHub's own UI) and every new pull request gets one advisory **Admission Decision** comment — verdict, reasons, -and a link to the signed receipt. **Comment-only; Umbra never merges.** +and a link to the signed receipt. **Comment-only; Signetry never merges.** -Part of the [Umbra platform](https://github.com/Signetry/signetry). -Governance logic lives in [umbra-core](https://github.com/Signetry/core); +Part of the [Signetry platform](https://github.com/Signetry/signetry). +Governance logic lives in [signetry-core](https://github.com/Signetry/core); the App is served by the hosted [`umbra`](https://github.com/bkd-dotcom/umbra) service. This repository is the App's **public home**: its manifest, setup docs, and configuration — not a second copy of the governance pipeline. @@ -20,7 +20,7 @@ and configuration — not a second copy of the governance pipeline. 1. A single app-level webhook (`POST /api/github/app/webhook`, hosted by `umbra`) receives PR events for every installation; each delivery is HMAC-verified. -2. On a reviewable PR, Umbra mints a **short-lived installation token** from the +2. On a reviewable PR, Signetry mints a **short-lived installation token** from the App's private key, reads the diff, runs the admission review (comment-only), and posts one comment. 3. The installation token is read-only for the diff and comment-only to post — it @@ -42,7 +42,7 @@ Full operator setup (secrets, Cloud Run): [SETUP.md](SETUP.md). - **Never merges.** `auto_merge` is always false — a human merges. - The comment restates the signed receipt; it never claims more than the receipt. -- Governance is `umbra-core`; this repo carries no policy logic. +- Governance is `signetry-core`; this repo carries no policy logic. See [SECURITY.md](SECURITY.md) · [umbrella overview](https://github.com/Signetry/signetry). diff --git a/SECURITY.md b/SECURITY.md index f6e9e40..6482128 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,13 +1,13 @@ # Security policy -The Umbra GitHub App is served by the hosted [`umbra`](https://github.com/bkd-dotcom/umbra) -service and governed by [umbra-core](https://github.com/Signetry/core). +The Signetry GitHub App is served by the hosted [`umbra`](https://github.com/bkd-dotcom/umbra) +service and governed by [signetry-core](https://github.com/Signetry/core). This repo holds the App's manifest and setup docs only. ## Reporting Open a private security advisory on the relevant repository (`umbra` for the hosted -webhook/token handling, `umbra-core` for governance), or use the umbrella contact: +webhook/token handling, `signetry-core` for governance), or use the umbrella contact: . Do not open a public issue for an unpatched vulnerability. diff --git a/SETUP.md b/SETUP.md index d3ab19a..79e0a8b 100644 --- a/SETUP.md +++ b/SETUP.md @@ -1,6 +1,6 @@ -# Umbra GitHub App — install-once PR auto-review +# Signetry GitHub App — install-once PR auto-review -Umbra's autonomous PR review is an **install-once GitHub App**. A user installs it on their account or +Signetry's autonomous PR review is an **install-once GitHub App**. A user installs it on their account or org (choosing repos in GitHub's own UI), and every new pull request gets one advisory review comment — public or private repos, any account, **never merges**. There are no per-repo webhooks and no stored user token: reviews are posted **as the App**, using a short-lived installation token minted from the App's @@ -10,21 +10,21 @@ private key. 1. A single app-level webhook (`POST /api/github/app/webhook`) receives PR events for **every** installation. Each delivery is HMAC-verified against the App's webhook secret. -2. On a reviewable PR (`opened` / `reopened` / `synchronize` / `ready_for_review`), Umbra mints an +2. On a reviewable PR (`opened` / `reopened` / `synchronize` / `ready_for_review`), Signetry mints an installation access token from the App's private key (`GithubIntegration.get_access_token`), reads the PR diff, runs the Reviewer (comment-only, `allow_codex=False`), and posts one comment. 3. The install's repos are tracked from the `installation` / `installation_repositories` events so the - dashboard can show what's covered. The `Setup URL` links an install to the signed-in Umbra user. + dashboard can show what's covered. The `Setup URL` links an install to the signed-in Signetry user. The installation token is short-lived, used read-only for the diff/clone and comment-only to post — it is **never** passed to the Codex child process. ## One-time setup (operator) -Create the App under your GitHub account (this is the only step Umbra cannot do for you): +Create the App under your GitHub account (this is the only step Signetry cannot do for you): 1. GitHub → **Settings → Developer settings → GitHub Apps → New GitHub App**. -2. **Name:** `Umbra Engineer` (this sets the install slug). **Homepage:** `https://umbra.engineer`. +2. **Name:** `Signetry Engineer` (this sets the install slug). **Homepage:** `https://umbra.engineer`. 3. **Webhook:** Active ✓ · **URL** `https://umbra.engineer/api/github/app/webhook` · **Secret:** a fresh random string (save it). 4. **Repository permissions:** Pull requests → **Read & write**; Contents → **Read-only**; Metadata → @@ -57,7 +57,7 @@ Never paste the private key or webhook secret into code, logs, or chat. (no valid signature) → **503**. - After secrets land: `GET /api/github/app` → `{"configured": true, "install_url": "https://github.com/apps//installations/new"}`; an unsigned/bad-signature POST → **401**; a validly-signed `ping` → **200**. -- End-to-end: install the App on a repo → open a PR → an **🌑 Umbra Review** comment appears within a few +- End-to-end: install the App on a repo → open a PR → an **🌑 Signetry Review** comment appears within a few seconds; the dashboard lists the repo under "Autonomous PR auto-review". Failures are logged under the `umbra.webhook` logger (grep Cloud Run logs). diff --git a/app-manifest.json b/app-manifest.json index 483ce77..f477577 100644 --- a/app-manifest.json +++ b/app-manifest.json @@ -1,5 +1,5 @@ { - "name": "Umbra Engineer", + "name": "Signetry Engineer", "url": "https://umbra.engineer", "hook_attributes": { "url": "https://umbra.engineer/api/github/app/webhook", @@ -19,5 +19,5 @@ "contents": "read", "metadata": "read" }, - "description": "Umbra governs coding-agent pull requests: every new PR gets one advisory admission review comment (verdict + reasons + signed receipt). Comment-only — Umbra never merges. auto_merge is always false." + "description": "Signetry governs coding-agent pull requests: every new PR gets one advisory admission review comment (verdict + reasons + signed receipt). Comment-only — Signetry never merges. auto_merge is always false." }