trails-cool/trails
Watch
1
1
Fork
You've already forked trails
 0
Code Issues 2 Pull requests Projects Releases Packages Activity Actions 9

chore: retire GitHub references across docs, links, and workflows #26

Merged
ullrich merged 1 commit from chore/retire-github-references into main 2026-07-27 16:58:52 +00:00
Conversation 0 Commits 1 Files changed 11 +64 -28
ullrich commented 2026-07-27 16:37:12 +00:00
Owner
Copy link

GitHub was retired on 2026-07-27, but 21 files still pointed at it. Two were broken in production.

The 404s

Deleting main on GitHub broke two user-facing paths:

Link Was Where
github.com/trails-cool/trails/blob/main/SECURITY.md 404 Live privacy policy, as the vulnerability-reporting destination
raw.githubusercontent.com/…/main/infrastructure/docker-compose.yml 404 README self-hosting step

So someone following our own security-contact path hit a dead page, and anyone following the install instructions failed at step one.

Both now point at git.ullrich.is. Because these are public-facing, I verified them anonymously with no token — existence isn't the requirement, reachability without credentials is:

https://git.ullrich.is/trails-cool/trails                                    200
https://git.ullrich.is/trails-cool/trails/src/branch/main/SECURITY.md        200
https://git.ullrich.is/trails-cool/trails/raw/branch/main/…compose.yml       200
git clone over HTTPS (info/refs?service=git-upload-pack)                    200

Also repointed: journal footer + planner landing "source" links (these resolved to the moved stub), SECURITY.md scope, the BRouter host runbook's clone step, and docs/architecture.md, which still called CI/CD "GitHub Actions" and named the GitHub org as the repo's home.

CLAUDE.md documented a workflow that cannot work

The Git Workflow section instructed gh pr list, gh pr create, gh pr merge --merge --auto, and a GitHub merge queue. gh does not talk to Forgejo — every command in that section failed. Replaced with Forgejo API equivalents, and stated plainly that there is no merge queue (#25 tracks the evaluation), including the consequence that matters: PRs are tested against their base at push time, not merge time, which is the real risk when landing stacked work quickly.

Two dead conditions, handled differently on purpose

  • ci.yml gated Gitleaks on github.actor != 'dependabot[bot]'. That existed because Dependabot PRs ran without secret access, so GITLEAKS_LICENSE was empty and the scan failed. Dependabot cannot exist on Forgejo and Renovate runs with full secret access — so the gate is removed, not ported. A dependency bump is exactly when a secret can slip into a lockfile; that scan should run.
  • cd-staging.yml excluded dependabot/github_actions/ head refs from preview deploys. That intent still applies to Renovate, so it is ported to renovate/ rather than deleted.

Deliberately kept

  • .github/copilot-instructions.md — I flagged this as vestigial earlier and was wrong. It is a 3-line pointer to CLAUDE.md; Copilot reads it in-editor independent of GitHub hosting, and its content is accurate. Deleting it would break something still working.
  • openspec/changes/archive/** and docs/conversations/** — historical record. Rewriting them would falsify what happened.
  • uses: https://github.com/trails-cool/gitleaks-action@<sha> — a live dependency on a GitHub-hosted fork under our own org. Verified both the repo and the pinned SHA still resolve (200). Worth knowing that "GitHub is retired" is not quite complete while CI resolves an action from there; mirroring it to Forgejo is a real follow-up, not a search-and-replace.

Verification

pnpm typecheck 14/14 and pnpm lint 14/14 pass. pnpm test needed two runs to be trustworthy: the first reported 5 packages failing, the re-run passed 12/12 clean with no code change between them, and @trails-cool/fit passed in isolation — contention from running the three suites back-to-back locally, not this diff. Also confirmed no test or e2e spec asserts any of the changed hrefs, so nothing was silently coupled to the old URLs.

Memories were updated in the same sweep (outside the repo), most importantly one that told future sessions "GitHub kept as mirror — do NOT remove anything from GitHub" — now struck through and superseded.

GitHub was retired on 2026-07-27, but 21 files still pointed at it. **Two were broken in production.** ## The 404s Deleting `main` on GitHub broke two user-facing paths: | Link | Was | Where | |---|---|---| | `github.com/trails-cool/trails/blob/main/SECURITY.md` | **404** | Live privacy policy, as the vulnerability-reporting destination | | `raw.githubusercontent.com/…/main/infrastructure/docker-compose.yml` | **404** | README self-hosting step | So someone following our own security-contact path hit a dead page, and anyone following the install instructions failed at step one. Both now point at `git.ullrich.is`. Because these are public-facing, I verified them **anonymously with no token** — existence isn't the requirement, reachability without credentials is: ``` https://git.ullrich.is/trails-cool/trails 200 https://git.ullrich.is/trails-cool/trails/src/branch/main/SECURITY.md 200 https://git.ullrich.is/trails-cool/trails/raw/branch/main/…compose.yml 200 git clone over HTTPS (info/refs?service=git-upload-pack) 200 ``` Also repointed: journal footer + planner landing "source" links (these resolved to the `moved` stub), SECURITY.md scope, the BRouter host runbook's clone step, and `docs/architecture.md`, which still called CI/CD "GitHub Actions" and named the GitHub org as the repo's home. ## CLAUDE.md documented a workflow that cannot work The Git Workflow section instructed `gh pr list`, `gh pr create`, `gh pr merge --merge --auto`, and a GitHub merge queue. `gh` does not talk to Forgejo — **every command in that section failed.** Replaced with Forgejo API equivalents, and stated plainly that there is no merge queue (#25 tracks the evaluation), including the consequence that matters: PRs are tested against their base **at push time, not merge time**, which is the real risk when landing stacked work quickly. ## Two dead conditions, handled differently on purpose - **`ci.yml`** gated Gitleaks on `github.actor != 'dependabot[bot]'`. That existed because Dependabot PRs ran without secret access, so `GITLEAKS_LICENSE` was empty and the scan failed. Dependabot cannot exist on Forgejo and Renovate runs with full secret access — so the gate is **removed**, not ported. A dependency bump is exactly when a secret can slip into a lockfile; that scan should run. - **`cd-staging.yml`** excluded `dependabot/github_actions/` head refs from preview deploys. That intent still applies to Renovate, so it is **ported** to `renovate/` rather than deleted. ## Deliberately kept - **`.github/copilot-instructions.md`** — I flagged this as vestigial earlier and was wrong. It is a 3-line pointer to `CLAUDE.md`; Copilot reads it in-editor independent of GitHub hosting, and its content is accurate. Deleting it would break something still working. - **`openspec/changes/archive/**` and `docs/conversations/**`** — historical record. Rewriting them would falsify what happened. - **`uses: https://github.com/trails-cool/gitleaks-action@<sha>`** — a live dependency on a GitHub-hosted fork under our own org. Verified both the repo and the pinned SHA still resolve (200). Worth knowing that "GitHub is retired" is not quite complete while CI resolves an action from there; mirroring it to Forgejo is a real follow-up, not a search-and-replace. ## Verification `pnpm typecheck` 14/14 and `pnpm lint` 14/14 pass. `pnpm test` needed two runs to be trustworthy: the first reported 5 packages failing, the re-run passed 12/12 clean with no code change between them, and `@trails-cool/fit` passed in isolation — contention from running the three suites back-to-back locally, not this diff. Also confirmed **no test or e2e spec asserts any of the changed hrefs**, so nothing was silently coupled to the old URLs. Memories were updated in the same sweep (outside the repo), most importantly one that told future sessions *"GitHub kept as mirror — do NOT remove anything from GitHub"* — now struck through and superseded.
chore: retire GitHub references across docs, links, and workflows
All checks were successful
CD Staging / Build & Push Docker Images (pull_request) Has been skipped
Details
CD Staging / Build & Push Docker Images-1 (pull_request) Has been skipped
Details
CD Staging / Deploy Staging (pull_request) Has been skipped
Details
CD Staging / Deploy PR Preview (pull_request) Has been skipped
Details
CI / Dockerfile Package Check (pull_request) Successful in 16s
Details
CI / Security Scan (pull_request) Successful in 50s
Details
CI / Visual Tests (pull_request) Successful in 2m37s
Details
CI / Checks (pull_request) Successful in 4m16s
Details
CI / Journal Image Smoke Test (pull_request) Successful in 6m30s
Details
CI / E2E Tests (pull_request) Successful in 8m54s
Details
CD Staging / Tear Down PR Preview (pull_request) Successful in 31s
Details
5640658c0e
 
GitHub was retired on 2026-07-27, but the repo still pointed at it in 21
files. Two of those were broken in production.

User-facing 404s (both caused by deleting `main` on GitHub):

- The **privacy policy** linked vulnerability reporting to
  `github.com/trails-cool/trails/blob/main/SECURITY.md` -> 404. Someone
  following our own security-contact path hit a dead page.
- The **README's self-hosting step** curled
  `raw.githubusercontent.com/.../main/infrastructure/docker-compose.yml`
  -> 404, so anyone following the install instructions failed at step one.

Both now point at git.ullrich.is. Verified anonymously (no token) that the
repo, `src/branch/main/SECURITY.md`, the raw compose URL, and anonymous
`git clone` over HTTPS all return 200 — these are public-facing links, so
reachability without credentials is the requirement, not just existence.

Also repointed: journal footer + planner landing "source" links (resolved
to the `moved` stub), SECURITY.md scope, the BRouter host runbook's clone
step, and docs/architecture.md (which still called CI/CD "GitHub Actions"
and named the GitHub org as the repo's home).

CLAUDE.md's Git Workflow documented a workflow that cannot work: `gh pr
list`, `gh pr create`, `gh pr merge --merge --auto`, and a GitHub merge
queue. `gh` does not talk to Forgejo, so every command in that section
failed. Replaced with the Forgejo API equivalents, and stated plainly that
there is no merge queue (issue #25 tracks the evaluation) — including the
consequence that PRs are tested against their base at push time, not merge
time, which is the actual risk when landing stacked work.

Two dead workflow conditions, handled differently on purpose:

- `ci.yml` gated Gitleaks on `github.actor != 'dependabot[bot]'`, which
  existed because Dependabot PRs had no secret access. Dependabot cannot
  exist on Forgejo and Renovate runs with full secret access, so the gate
  is *removed* — a dependency bump is exactly when a secret can slip into
  a lockfile, so the scan should run.
- `cd-staging.yml` excluded `dependabot/github_actions/` head refs from
  preview deploys. That intent still applies, so it is *ported* to
  `renovate/` rather than deleted.

Deliberately kept:

- `.github/copilot-instructions.md` — a 3-line pointer to CLAUDE.md.
  Copilot reads it in-editor independent of GitHub hosting, and its
  content is accurate, so removing it would break something still working.
- `openspec/changes/archive/**` and `docs/conversations/**` — historical
  record; rewriting them would falsify what happened.
- `uses: https://github.com/trails-cool/gitleaks-action@<sha>` — a live
  dependency on a GitHub-hosted fork. Verified still reachable. Mirroring
  it to Forgejo is a real follow-up, not a search-and-replace.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01X8hNxgYp777FRqYtVmQNaU
ullrich deleted branch chore/retire-github-references 2026-07-27 16:58:52 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
dependencies
Dependency updates raised by Renovate (renovate.json5 labels)

  
major
Major version bump — always needs human review, never auto-merged

  
security-pin
Touches a pnpm.overrides CVE remediation pin, not an ordinary dependency

No labels
dependencies
major
security-pin
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
trails-cool/trails!26
No description provided.