chore: update all repo URLs to codecoradev/cora-cli

[ajianaz]

Post-migration URL update

Update all references to after repo transfer.

Files changed: 11 (Cargo.toml, README, CHANGELOG, CONTRIBUTING, AGENT.md, init.rs, release.yml, cora-review actions, website docs)

No functional changes — URL string replacements only.

Closes #123

[github-actions]

🔍 Cora AI Code Review

❌ Blocked — critical issues found.

🔴 Error (3)

• .github/actions/cora-review/action.yml:106 — The cora-api-key is declared as an inputs field. GitHub Actions inputs are visible in workflow run logs and can be exposed through debug logging, step annotations, or when the workflow is re-run with debug enabled. The previous Infisical OIDC approach kept secrets out of GitHub entirely. Now the API key flows through inputs → env which is a less secure pattern. Consider using GitHub Secrets directly mapped to environment variables instead of passing through action inputs.
• .github/actions/cora-review/action.yml:106 — The cora-review-simple action downloads a binary via curl | tar xz -C /usr/local/bin without any checksum verification. While the cora-review action does attempt checksum verification, the simple variant pipes directly from curl into tar, which is vulnerable to MITI (man-in-the-middle) attacks. A compromised download could execute arbitrary code in the CI environment.
• .github/workflows/release.yml:97 — The line cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }} --allow-dirty passes the secret directly as a command argument. While GitHub masks secrets in logs, if the command fails or is run with certain debug options, the token could appear in error messages or process listings. The previous pattern of using an environment variable was safer.

---

Review powered by cora-cli · BYOK · MIT