Move zizmor to its own GitHub org

[woodruffw]

I'm filing this both to remind myself and as a transparency measure, so that people can confirm that the move is in fact authentic.

TL;DR: I plan on moving zizmor to https://github.com/zizmorcore (where it'll be https://github.com/zizmorcore/zizmor), starting after the next minor release (v1.7.0).

This should have no effect on the average user, since ordinary installation methods will continue to work and GitHub will perform the redirect as needed. However, some GitHub Pages URLs may break; I'll need to look into that before fully executing on the switch.

[miketheman]

This will likely break links that point to the current homepage for the project - https://woodruffw.github.io/zizmor/

Do you know what will happen if the project is moved to that link?

[woodruffw]

This will likely break links that point to the current homepage for the project - woodruffw.github.io/zizmor

Yeah, I think that's unfortunately correct.

I've been thinking about how best to accomplish this, and I think there are three methods, in order of increasing breakage for existing links:

1. Move to zizmorecore/zizmor, and then add a stub repository to woodruffw/zizmor that pubishes a GitHub Pages site that contains only stub pages that perform an HTML <meta> redirect to the new site.
   • Pros: should preserve all links, is relatively search engine friendly (all modern engines understand meta redirects FWICT)
   • Cons: slightly annoying to build, and breaks the thing that GitHub does do well (handling repo-level redirects). But this might be worth it; I'm not sure.
2. Buy a domain and put the zizmor docs on it, update links everywhere, and then perform the org migration. In other words, the zizmor docs would become something like https://zizmor.example.com/ and newer versions of zizmor would link to those pages directly.
   • Pros: fully general, insofar as the migration itself won't cause any problems.
   • Cons: This will still cause some link breakage for old versions of zizmor + anybody who has the old links saved anywhere, and requires a (small) amount of domain management.
3. Perform the repo migration and update URLs on a best-case basis.
   • Pros: easiest thing for me to do.
   • Cons: by far the most amount of link breakage, since everything will begin to 404.

I think (1) is what I should probably do, although the con about it breaking repo-level redirects is a significant one. To work around that I could maybe do something like:

1. Migrate woodruffw/zizmor -> zizmorcore/zizmor
2. Fork zizmorcore/zizmor back to woodruffw/zizmor and disable external PRs + add a notice in the README (not sure if disabling external PRs is possible?)
3. Update the fork and only the fork to include the page redirect changes

That would still break the repo redirects, but maybe (?) in a less confusing way than a completely unrelated pages-only repo would.

Curious if you have better ideas, though!

[miketheman]

I think that 1 is likeliest to preserve links, but looking at the docs, there's this semi-cryptic message:

If the transferred repository contains a GitHub Pages site, then links to the Git repository on the Web and through Git activity are redirected. However, we don't redirect GitHub Pages associated with the repository.

https://docs.github.com/en/repositories/creating-and-managing-repositories/transferring-a-repository#whats-transferred-with-a-repository

Maybe a simple experiment is in order?

[woodruffw]

If the transferred repository contains a GitHub Pages site, then links to the Git repository on the Web and through Git activity are redirected. However, we don't redirect GitHub Pages associated with the repository.

I think that's trying to say that https://github.com/woodruffw/zizmor/* is redirected correctly (including all individual Git web URLs). but that https://woodruffw.github.io/zizmor/* is never redirected and disappears once the transfer happens.

(IIRC, I accidentally tested this once with x509-limbo, when I moved it from trailofbits/x509-limbo to C2SP/x509-limbo, and all of the links did indeed break. In that case it wasn't so bad since it was pre-release and a much smaller project, but in that case I "fixed" it by creating a new domain and making that the canonical docs link.)

[miketheman]

In that case, I'm guessing a stub repo for redirection is worthwhile, at lease for a bit. And once live, you could archive it.

[woodruffw]

https://docs.zizmor.sh is now a thing!

I've begun moving live links to that, and I'll probably do several patch releases to nudge the living versions towards those links.

For handling the final redirects post-org migration, it looks like I can do something extremely cursed like this: https://gist.github.com/domenic/1f286d415559b56d725bee51a62c24a7

[woodruffw]

Update: I confirmed that the <username>.github.io repo with oldreponame/ subdir trick does indeed work, so I'll be able to do a pretty graceful transition here.

[woodruffw]

Done!