chore: address the instance as hephaestus.build (#1829)

Co-authored-by: Felix T.J. Dietrich <felix.dietrich@financial-health-initiative.org>

Author: FelixTJDietrich

.changeset/hephaestus-build-is-the-address.md

@@ -0,0 +1,9 @@
+---
+"hephaestus": patch
+---
+
+The TUM-operated instance is now addressed as `hephaestus.build`. The imprint, the privacy
+statement, the in-app footer links, `security.txt` and the documentation all name it, and the older
+`hephaestus.aet.cit.tum.de` address continues to reach the same instance. Source links follow the
+repository to the `hephaestus-build` organisation; images and signatures for releases cut before the
+move keep their original namespace and signing identity, so verifying an older release is unchanged.

README.md

@@ -9,11 +9,11 @@
   <p><strong>Learn from the work you're already doing</strong></p>
 
   <p>
-    <a href="https://hephaestus.aet.cit.tum.de"><img alt="Open the TUM-operated Hephaestus web app" src="https://img.shields.io/badge/web_app-try_it-493C83"></a>
+    <a href="https://hephaestus.build"><img alt="Open the TUM-operated Hephaestus web app" src="https://img.shields.io/badge/web_app-try_it-493C83"></a>
     <a href="https://docs.hephaestus.build/"><img alt="Read the Hephaestus documentation" src="https://img.shields.io/badge/docs-read_online-1F75CB?logo=docusaurus&logoColor=white"></a>
-    <a href="https://github.com/ls1intum/Hephaestus/releases/latest"><img alt="Latest Hephaestus release" src="https://img.shields.io/github/v/release/ls1intum/Hephaestus?display_name=tag&sort=semver"></a>
-    <a href="https://github.com/ls1intum/Hephaestus/actions/workflows/cicd.yml"><img alt="Hephaestus CI status" src="https://github.com/ls1intum/Hephaestus/actions/workflows/cicd.yml/badge.svg?branch=main"></a>
-    <a href="https://github.com/ls1intum/Hephaestus/blob/main/LICENSE"><img alt="MIT license" src="https://img.shields.io/github/license/ls1intum/Hephaestus"></a>
+    <a href="https://github.com/hephaestus-build/Hephaestus/releases/latest"><img alt="Latest Hephaestus release" src="https://img.shields.io/github/v/release/hephaestus-build/Hephaestus?display_name=tag&sort=semver"></a>
+    <a href="https://github.com/hephaestus-build/Hephaestus/actions/workflows/cicd.yml"><img alt="Hephaestus CI status" src="https://github.com/hephaestus-build/Hephaestus/actions/workflows/cicd.yml/badge.svg?branch=main"></a>
+    <a href="https://github.com/hephaestus-build/Hephaestus/blob/main/LICENSE"><img alt="MIT license" src="https://img.shields.io/github/license/hephaestus-build/Hephaestus"></a>
   </p>
 </div>
 
@@ -39,12 +39,12 @@ relationships stay with people.
 
 > [!IMPORTANT]
 > **Hephaestus is pre-1.0.** It is released continuously and only the
-> [latest release](https://github.com/ls1intum/Hephaestus/releases/latest) is supported — no
+> [latest release](https://github.com/hephaestus-build/Hephaestus/releases/latest) is supported — no
 > maintenance branches, no backports. Until 1.0, a *minor* release can change configuration or the
 > API in ways that need you to act, so read the release notes before every upgrade.
 > Version 1.0 is what makes upgrades, configuration, Compose and the REST API predictable:
 > [compatibility policy](https://docs.hephaestus.build/admin/compatibility-policy) ·
-> [1.0 milestone](https://github.com/ls1intum/Hephaestus/issues/1378).
+> [1.0 milestone](https://github.com/hephaestus-build/Hephaestus/issues/1378).
 
 ## What Hephaestus does
 
@@ -81,13 +81,13 @@ The feedback is advisory: it does not approve a change for merge or grade anyone
 
 ## Get started
 
-- **Try the hosted app:** open the [TUM deployment](https://hephaestus.aet.cit.tum.de).
+- **Try the hosted app:** open the [TUM deployment](https://hephaestus.build).
 - **Learn how it works:** read the [user guide](https://docs.hephaestus.build/user/overview).
 - **Run your own deployment.** One 64-bit Linux host, 4 vCPUs / 8 GB RAM / 40 GB SSD recommended:
 
   ```bash
   VERSION=0.76.0   # the release you are installing, without the leading "v"
-  sudo git clone --depth 1 --branch "v$VERSION" https://github.com/ls1intum/Hephaestus.git /opt/hephaestus
+  sudo git clone --depth 1 --branch "v$VERSION" https://github.com/hephaestus-build/Hephaestus.git /opt/hephaestus
   sudo chown -R "$USER" /opt/hephaestus
   cd /opt/hephaestus/docker/self-host
   cp .env.example .env
@@ -106,8 +106,8 @@ The feedback is advisory: it does not approve a change for merge or grade anyone
 
 ## Get help
 
-- Ask questions and share ideas in [GitHub Discussions](https://github.com/ls1intum/Hephaestus/discussions).
-- Report reproducible bugs in [GitHub Issues](https://github.com/ls1intum/Hephaestus/issues).
+- Ask questions and share ideas in [GitHub Discussions](https://github.com/hephaestus-build/Hephaestus/discussions).
+- Report reproducible bugs in [GitHub Issues](https://github.com/hephaestus-build/Hephaestus/issues).
 - Report security vulnerabilities privately as described in [SECURITY.md](./SECURITY.md).
 
 ## Contributing

SECURITY.md

@@ -4,7 +4,7 @@
 
 **Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
 
-Report privately via [GitHub private vulnerability reporting](https://github.com/ls1intum/Hephaestus/security/advisories/new) — it keeps the report confidential and credits you in the resulting advisory. If you cannot use GitHub, email [felixtj.dietrich@tum.de](mailto:felixtj.dietrich@tum.de) with the subject "Hephaestus Security Vulnerability Report".
+Report privately via [GitHub private vulnerability reporting](https://github.com/hephaestus-build/Hephaestus/security/advisories/new) — it keeps the report confidential and credits you in the resulting advisory. If you cannot use GitHub, email [felixtj.dietrich@tum.de](mailto:felixtj.dietrich@tum.de) with the subject "Hephaestus Security Vulnerability Report".
 
 Please include as much as you can:
 
@@ -19,7 +19,7 @@ Security reports are triaged before other work.
 
 - **Initial response within 14 days.**
 - We follow **coordinated disclosure**: please give us time to ship a fix before disclosing publicly. If we cannot agree on a timeline, we treat **90 days** from your report as the default disclosure date, shortened when a vulnerability is being actively exploited.
-- Confirmed vulnerabilities are fixed as soon as feasible and published as [GitHub Security Advisories](https://github.com/ls1intum/Hephaestus/security/advisories). You are credited unless you prefer to stay anonymous.
+- Confirmed vulnerabilities are fixed as soon as feasible and published as [GitHub Security Advisories](https://github.com/hephaestus-build/Hephaestus/security/advisories). You are credited unless you prefer to stay anonymous.
 
 We do not run a bug bounty program.
 
@@ -53,4 +53,4 @@ Independent of this reporting channel, the project runs:
 - **Static analysis**: GitHub CodeQL
 - **Native alerts**: GitHub secret scanning and Dependabot dependency alerts
 
-A machine-readable [`security.txt`](https://hephaestus.aet.cit.tum.de/.well-known/security.txt) ([RFC 9116](https://www.rfc-editor.org/info/rfc9116/)) points to this policy.
+A machine-readable [`security.txt`](https://hephaestus.build/.well-known/security.txt) ([RFC 9116](https://www.rfc-editor.org/info/rfc9116/)) points to this policy.

commitlint.config.ts

@@ -110,7 +110,7 @@ const helpfulErrorsPlugin = {
 const configuration = {
 	extends: ["@commitlint/config-conventional"],
 	plugins: [helpfulErrorsPlugin],
-	helpUrl: "https://github.com/ls1intum/Hephaestus/blob/main/CONTRIBUTING.md",
+	helpUrl: "https://github.com/hephaestus-build/Hephaestus/blob/main/CONTRIBUTING.md",
 	rules: {
 		// Use custom rules for helpful error messages
 		"type-enum-helpful": [2, "always"],

docker/preview/README.md

@@ -83,7 +83,7 @@ serialized through one Actions concurrency group, so previews never start at onc
 
 ## Coolify configuration
 
-Create one Docker Compose application for `ls1intum/Hephaestus` on branch `main` and point it at
+Create one Docker Compose application for `hephaestus-build/Hephaestus` on branch `main` and point it at
 `/docker/preview/compose.app.yaml`.
 
 1. Keep normal automatic deployment off. Disable the repository webhook that targets Coolify's

docs/admin/dsms/README.md

@@ -7,7 +7,7 @@ description: Art. 30 / Art. 35 / Art. 28 records and source-governance controls
 
 # Hephaestus — Data-Protection Documentation
 
-This folder is the data-protection package for the TUM-operated Hephaestus deployment at https://hephaestus.aet.cit.tum.de. Files are named after the GDPR articles they answer to, not after the TUM DSMS portal field labels. The portal supplies its own field prompts; submit by pasting from the fenced code blocks in `record-of-processing.md` into the corresponding form fields.
+This folder is the data-protection package for the TUM-operated Hephaestus deployment at https://hephaestus.build. Files are named after the GDPR articles they answer to, not after the TUM DSMS portal field labels. The portal supplies its own field prompts; submit by pasting from the fenced code blocks in `record-of-processing.md` into the corresponding form fields.
 
 A different operator forking Hephaestus must amend, before opening their deployment to users: the controller block in `record-of-processing.md`, the operational-contact email, the Art. 28 row for any processor they engage that is not on the AET pool, the consent / public-task framing in `record-of-processing.md` "Legal basis", and the live privacy notice and imprint under `webapp/public/legal/profiles/`.
 
@@ -21,7 +21,7 @@ A different operator forking Hephaestus must amend, before opening their deploym
 | [`artifact-source-governance.md`](./artifact-source-governance.md) | Approval, minimization, processor-egress, retention, and erasure gate for every AI-readable source. |
 | [`personal-data-map.md`](./personal-data-map.md) | Personal-data stores, export coverage, erasure paths, residual retention, and their verification. |
 
-The live imprint and privacy pages are at https://hephaestus.aet.cit.tum.de/imprint and https://hephaestus.aet.cit.tum.de/privacy. Markdown source: [`webapp/public/legal/profiles/tumaet/`](https://github.com/ls1intum/Hephaestus/tree/main/webapp/public/legal/profiles/tumaet).
+The live imprint and privacy pages are at https://hephaestus.build/imprint and https://hephaestus.build/privacy. Markdown source: [`webapp/public/legal/profiles/tumaet/`](https://github.com/hephaestus-build/Hephaestus/tree/main/webapp/public/legal/profiles/tumaet).
 
 ## Maintenance
 

docs/admin/dsms/artifact-source-governance.md

@@ -53,7 +53,7 @@ missing or expired is never read, whatever the deployment sets. Disabling a use
 contract version in which that decision no longer permits it.
 
 The runtime registry is
-[`source-use-decisions.json`](https://github.com/ls1intum/Hephaestus/blob/main/server/application/src/main/resources/contracts/artifact-source/1.0.0/source-use-decisions.json).
+[`source-use-decisions.json`](https://github.com/hephaestus-build/Hephaestus/blob/main/server/application/src/main/resources/contracts/artifact-source/1.0.0/source-use-decisions.json).
 It is an engineering gate and contains only releasable decision summaries. Each record governs exactly one source-use purpose; a source references separate records for automated review, feedback delivery, Mentor context, and operator evidence review:
 
 - `ENGINEERING_BASELINE` with `ENGINEERING_APPROVED` records maintainer approval of the shipped, minimized

docs/admin/dsms/record-of-processing.md

@@ -1,6 +1,6 @@
 # Hephaestus — Record of Processing Activities (Art. 30 GDPR)
 
-This file is the Art. 30 record for the TUM-operated Hephaestus deployment at https://hephaestus.aet.cit.tum.de. Each section maps to a single Art. 30 element. Fenced code blocks are paste-ready into the corresponding TUM DSMS form field at https://dsms.datenschutz.tum.de/; everything outside the fences is contextual.
+This file is the Art. 30 record for the TUM-operated Hephaestus deployment at https://hephaestus.build. Each section maps to a single Art. 30 element. Fenced code blocks are paste-ready into the corresponding TUM DSMS form field at https://dsms.datenschutz.tum.de/; everything outside the fences is contextual.
 
 ## Identifier
 
@@ -29,7 +29,7 @@ DSMS responsible person: Stephan Krusche (krusche@tum.de). Felix Dietrich (felix
 ## Purpose and description (Art. 30(1)(b))
 
 ```text
-Hephaestus is a self-hosted web platform operated by AET on TUM infrastructure at https://hephaestus.aet.cit.tum.de. Its purpose is to support project-based software-engineering teaching at TUM and the development work of AET research projects by giving each contributor feedback on their collaborative engineering work: for example, whether a pull request is small enough to review well, or whether a review reply addresses the question raised.
+Hephaestus is a self-hosted web platform operated by AET on TUM infrastructure at https://hephaestus.build. Its purpose is to support project-based software-engineering teaching at TUM and the development work of AET research projects by giving each contributor feedback on their collaborative engineering work: for example, whether a pull request is small enough to review well, or whether a review reply addresses the question raised.
 
 A workspace administrator connects one or more Git repositories from github.com or gitlab.lrz.de. Hephaestus then synchronises the pull/merge requests, issues, code reviews, review comments, and commit metadata authored in those repositories. The platform processes activity authored in the connected repositories, whether or not the author has signed in to Hephaestus.
 
@@ -93,7 +93,7 @@ U.S. recipients are covered by the EU-US Data Privacy Framework (Commission Impl
 **Where stored**
 
 ```text
-Self-hosted by AET at https://hephaestus.aet.cit.tum.de on AET-administered infrastructure at TUM. Application data — including authentication state (accounts, federated identity links, the cookie-session revocation list, and the auth-event log) — in PostgreSQL, which also holds the practice-review job queue; webhook and integration-sync events in NATS JetStream. Local working copies of monitored repositories may be stored on the host filesystem when practice-review code execution is enabled. Container stdout goes to the Docker json-file driver. Every service in the stack sets an explicit rotation cap in the compose files: 50 MiB per file × 5 files for the webapp, the application server, the worker and PostgreSQL; 10 MiB × 3 for the webhook receiver, NATS, the reverse proxy and the maintenance page. No layer of the stack writes an HTTP access log — Tomcat's is explicitly disabled in the production profile, the Traefik reverse proxy is not started with `--accesslog` (Traefik's default is off), and both nginx containers (the static frontend and the maintenance page) disable it at the server level. No per-request IP/URL record is created anywhere.
+Self-hosted by AET at https://hephaestus.build on AET-administered infrastructure at TUM. Application data — including authentication state (accounts, federated identity links, the cookie-session revocation list, and the auth-event log) — in PostgreSQL, which also holds the practice-review job queue; webhook and integration-sync events in NATS JetStream. Local working copies of monitored repositories may be stored on the host filesystem when practice-review code execution is enabled. Container stdout goes to the Docker json-file driver. Every service in the stack sets an explicit rotation cap in the compose files: 50 MiB per file × 5 files for the webapp, the application server, the worker and PostgreSQL; 10 MiB × 3 for the webhook receiver, NATS, the reverse proxy and the maintenance page. No layer of the stack writes an HTTP access log — Tomcat's is explicitly disabled in the production profile, the Traefik reverse proxy is not started with `--accesslog` (Traefik's default is off), and both nginx containers (the static frontend and the maintenance page) disable it at the server level. No per-request IP/URL record is created anywhere.
 
 Application and authentication data reside on TUM infrastructure within the EU. AI-assisted features additionally forward code snippets and surrounding discussion to the workspace-configured LLM provider (default for the TUM-operated deployment: Microsoft Azure OpenAI in an EU region).
 ```
@@ -246,8 +246,8 @@ DSMS multi-select: tick `Data received from third parties` and `Directly from th
 
 ## Information duty (Art. 13)
 
-- https://hephaestus.aet.cit.tum.de/privacy
-- https://hephaestus.aet.cit.tum.de/imprint
+- https://hephaestus.build/privacy
+- https://hephaestus.build/imprint
 
 Markdown source under `webapp/public/legal/profiles/tumaet/`.
 

docs/auth-glossary.md

@@ -40,7 +40,7 @@ Strict subset of standard OIDC ID-Token claims:
 
 | Claim | Type | Notes |
 |---|---|---|
-| `iss` | string | `https://hephaestus.aet.cit.tum.de` (env-configurable). |
+| `iss` | string | `https://hephaestus.build` (env-configurable). |
 | `sub` | string | `Account.id` as decimal. |
 | `aud` | string | `hephaestus-spa` for the SPA cookie. Future audiences allowed. |
 | `jti` | UUID | Inserted into `issued_jwt`. |

docs/docusaurus.config.ts

@@ -60,7 +60,7 @@ const config: Config = {
 	},
 
 	customFields: {
-		productUrl: "https://hephaestus.aet.cit.tum.de",
+		productUrl: "https://hephaestus.build",
 		repoUrl: "https://github.com/ls1intum/Hephaestus",
 	},
 
@@ -201,7 +201,7 @@ const config: Config = {
 				},
 
 				{
-					href: "https://hephaestus.aet.cit.tum.de",
+					href: "https://hephaestus.build",
 					label: "Open Hephaestus",
 					position: "right",
 				},
@@ -237,7 +237,7 @@ const config: Config = {
 						},
 						{
 							label: "Open Hephaestus",
-							href: "https://hephaestus.aet.cit.tum.de",
+							href: "https://hephaestus.build",
 						},
 					],
 				},
@@ -271,11 +271,11 @@ const config: Config = {
 						},
 						{
 							label: "Imprint",
-							href: "https://hephaestus.aet.cit.tum.de/imprint",
+							href: "https://hephaestus.build/imprint",
 						},
 						{
 							label: "Privacy",
-							href: "https://hephaestus.aet.cit.tum.de/privacy",
+							href: "https://hephaestus.build/privacy",
 						},
 					],
 				},