chore(config): point the updater at the now-public AeroFetch repo #13

2026-07-10T10:40:29-04:00

debont80 commented

2026-07-10 10:40:29 -04:00

Consolidates the update infrastructure back to a single repo now that debont80/AeroFetch is public.

Change: UPDATE_REPO retargets from AeroFetch-releases back to AeroFetch. The separate releases-only repo existed only to keep the updater tokenless while the source repo was private; with the source repo public, it can serve its own releases anonymously and the split is retired. The .gitignore note for the retired .update-token file is refreshed to match.

Ops already done (this session):

debont80/AeroFetch flipped to public.
Secret scan clean: gitleaks over all 150 commits found no leaks; the baked-token era never committed a literal secret.
The dedicated read-only baked-token service account (aerofetch-updater) was deleted and its token verified revoked (401).

Verified: anonymous read of AeroFetch/releases/latest returns 200 (tokenless updater works); a revoked token returns 401 (legacy token-bearing ≤0.6.1 clients are cleanly deprecated, per the public-only migration).

After merge: cut 0.7.2 (ships this retarget), publish it to the public AeroFetch repo, verify tokenless releases/latest, then AeroFetch-releases can be deleted.

DoD green: typecheck, lint, 416 tests.

Consolidates the update infrastructure back to a single repo now that `debont80/AeroFetch` is public. **Change:** `UPDATE_REPO` retargets from `AeroFetch-releases` back to `AeroFetch`. The separate releases-only repo existed only to keep the updater tokenless while the source repo was private; with the source repo public, it can serve its own releases anonymously and the split is retired. The `.gitignore` note for the retired `.update-token` file is refreshed to match. **Ops already done (this session):** - `debont80/AeroFetch` flipped to public. - Secret scan clean: `gitleaks` over all 150 commits found no leaks; the baked-token era never committed a literal secret. - The dedicated read-only baked-token service account (`aerofetch-updater`) was deleted and its token verified revoked (401). **Verified:** anonymous read of `AeroFetch/releases/latest` returns 200 (tokenless updater works); a revoked token returns 401 (legacy token-bearing ≤0.6.1 clients are cleanly deprecated, per the public-only migration). **After merge:** cut 0.7.2 (ships this retarget), publish it to the public `AeroFetch` repo, verify tokenless `releases/latest`, then `AeroFetch-releases` can be deleted. DoD green: typecheck, lint, 416 tests.

debont80 added 1 commit 2026-07-10 10:40:29 -04:00

chore(config): point the updater at the now-public AeroFetch repo 3b9dd6788d

The source repo is public now, so the separate releases-only repo
(AeroFetch-releases) is no longer needed to keep the updater tokenless.
Retarget UPDATE_REPO from AeroFetch-releases back to AeroFetch and refresh the
config doc comment. The dedicated read-only baked-token service account
(aerofetch-updater) has been deleted and its token revoked, so nothing reads a
token any more; the .gitignore comment for the retired .update-token file is
updated to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

debont80 merged commit 78a168ca5c into main

2026-07-10 10:41:29 -04:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: debont80/AeroFetch#13