fix(website): migrate Pages URLs to OWASP

.github/workflows/website.yml

@@ -1,8 +1,8 @@
-# Website pipeline: build check on every PR, deploy to Pages on dev.
+# Website pipeline: build check on every PR, deploy to Pages from main.
 #
-# The site follows dev (the default branch), which moves continuously, while
-# main only receives release merges, so publishing from dev keeps the site
-# from going stale between releases.
+# main is the release-controlled source for the official OWASP site. Changes
+# can be validated and integrated through dev without becoming public before
+# their promotion to main.
 #
 # The site derives its numbers (rules, domains, playbooks, contributors,
 # releases, docs index) from the repository at build time, so a full clone
@@ -12,7 +12,7 @@ name: website
 
 on:
   push:
-    branches: [dev]
+    branches: [main]
   pull_request:
     branches: [dev, main]
   workflow_dispatch:
@@ -62,14 +62,14 @@ jobs:
         run: npm run verify
 
       - name: Upload Pages artifact
-        if: github.ref == 'refs/heads/dev' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+        if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
         uses: actions/upload-pages-artifact@7b1f4a764d45c48632c6b24a0339c27f5614fb0b # v4.0.0
         with:
           path: website/dist
 
   deploy:
     name: Deploy to GitHub Pages
-    if: github.ref == 'refs/heads/dev' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
+    if: github.ref == 'refs/heads/main' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
     needs: build
     runs-on: ubuntu-latest
     timeout-minutes: 10

CHANGELOG.md

@@ -123,9 +123,9 @@ OpenShield uses [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 - GitHub Actions continuous integration pipeline
 - SBOM generation with Syft
 
-[Unreleased]: https://github.com/openshield-org/openshield/compare/v0.3.0...HEAD
-[0.3.0]: https://github.com/openshield-org/openshield/releases/tag/v0.3.0
-[0.2.3]: https://github.com/openshield-org/openshield/commit/3d6d7cc
-[0.2.2]: https://github.com/openshield-org/openshield/commit/9575a33
-[0.2.0]: https://github.com/openshield-org/openshield/commit/484eb9b
-[0.1.0]: https://github.com/openshield-org/openshield/releases/tag/v0.1.0
+[Unreleased]: https://github.com/OWASP/openshield/compare/v0.3.0...HEAD
+[0.3.0]: https://github.com/OWASP/openshield/releases/tag/v0.3.0
+[0.2.3]: https://github.com/OWASP/openshield/commit/3d6d7cc
+[0.2.2]: https://github.com/OWASP/openshield/commit/9575a33
+[0.2.0]: https://github.com/OWASP/openshield/commit/484eb9b
+[0.1.0]: https://github.com/OWASP/openshield/releases/tag/v0.1.0

CONTRIBUTING.md

@@ -31,7 +31,7 @@ Every misconfiguration rule is a self-contained Python file in `scanner/rules/`.
 
 ### Step 1 - Pick an Issue
 
-Browse issues labelled [`good-first-issue`](https://github.com/openshield-org/openshield/issues?q=label%3Agood-first-issue) or [`help-wanted`](https://github.com/openshield-org/openshield/issues?q=label%3Ahelp-wanted).
+Browse issues labelled [`good-first-issue`](https://github.com/OWASP/openshield/issues?q=label%3Agood-first-issue) or [`help-wanted`](https://github.com/OWASP/openshield/issues?q=label%3Ahelp-wanted).
 
 Comment on the issue: **"I'd like to work on this"** - we will assign it to you.
 

README.md

@@ -9,20 +9,20 @@
 
 **Open source Cloud Security Posture Management (CSPM) for Azure** detect misconfigurations, map them to CIS / NIST / ISO 27001 / SOC 2, remediate with one command, and identify cryptographic assets requiring quantum-safe migration.
 
-[**Website**](https://openshield-org.github.io/openshield/) · [**Documentation**](docs/) · [**Roadmap**](ROADMAP.md) · [**Changelog**](CHANGELOG.md) · [**Security Policy**](.github/SECURITY.md) · [**Discord**](https://discord.gg/openshield)
+[**Website**](https://owasp.github.io/openshield/) · [**Documentation**](docs/) · [**Roadmap**](ROADMAP.md) · [**Changelog**](CHANGELOG.md) · [**Security Policy**](.github/SECURITY.md) · [**Discord**](https://discord.gg/openshield)
 
 [![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13618/badge)](https://www.bestpractices.dev/projects/13618)
-[![OpenShield CI](https://github.com/openshield-org/openshield/actions/workflows/ci.yml/badge.svg)](https://github.com/openshield-org/openshield/actions/workflows/ci.yml)
-[![CodeQL](https://github.com/openshield-org/openshield/actions/workflows/codeql.yml/badge.svg)](https://github.com/openshield-org/openshield/actions/workflows/codeql.yml)
-[![Deploy](https://github.com/openshield-org/openshield/actions/workflows/deploy.yml/badge.svg?branch=dev)](https://github.com/openshield-org/openshield/actions/workflows/deploy.yml)
+[![OpenShield CI](https://github.com/OWASP/openshield/actions/workflows/ci.yml/badge.svg)](https://github.com/OWASP/openshield/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/OWASP/openshield/actions/workflows/codeql.yml/badge.svg)](https://github.com/OWASP/openshield/actions/workflows/codeql.yml)
+[![Deploy](https://github.com/OWASP/openshield/actions/workflows/deploy.yml/badge.svg?branch=dev)](https://github.com/OWASP/openshield/actions/workflows/deploy.yml)
 [![OWASP](https://img.shields.io/badge/OWASP-listing%20review-orange.svg)](https://owasp.org)
 
 [![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](https://opensource.org/licenses/MIT)
 [![Python 3.11](https://img.shields.io/badge/python-3.11-blue.svg)](https://www.python.org/downloads/release/python-3110/)
-[![GitHub Repo stars](https://img.shields.io/github/stars/openshield-org/openshield?style=flat-square)](https://github.com/openshield-org/openshield/stargazers)
-[![GitHub contributors](https://img.shields.io/github/contributors/openshield-org/openshield?style=flat-square)](https://github.com/openshield-org/openshield/graphs/contributors)
-[![GitHub last commit](https://img.shields.io/github/last-commit/openshield-org/openshield?style=flat-square)](https://github.com/openshield-org/openshield/commits/main)
-[![GitHub issues](https://img.shields.io/github/issues/openshield-org/openshield?style=flat-square)](https://github.com/openshield-org/openshield/issues)
+[![GitHub Repo stars](https://img.shields.io/github/stars/OWASP/openshield?style=flat-square)](https://github.com/OWASP/openshield/stargazers)
+[![GitHub contributors](https://img.shields.io/github/contributors/OWASP/openshield?style=flat-square)](https://github.com/OWASP/openshield/graphs/contributors)
+[![GitHub last commit](https://img.shields.io/github/last-commit/OWASP/openshield?style=flat-square)](https://github.com/OWASP/openshield/commits/main)
+[![GitHub issues](https://img.shields.io/github/issues/OWASP/openshield?style=flat-square)](https://github.com/OWASP/openshield/issues)
 [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen.svg)](CONTRIBUTING.md)
 [![Discord](https://img.shields.io/badge/Discord-Join%20Us-7289da)](https://discord.gg/openshield)
 
@@ -64,7 +64,7 @@ Findings map to NIST FIPS 203 (ML-KEM), FIPS 204 (ML-DSA), and FIPS 205 (SLH-DSA
 | **Scan History API** | Stores scans and findings in PostgreSQL and exposes findings, score, scan history, compliance posture, drift, and resource inventory over REST |
 | **Remediation Playbooks** | Every rule ships with a matching Azure CLI remediation script (95 playbooks) |
 | **Security Dashboard** | Full React dashboard deployed on Vercel - live monitoring, findings, compliance, drift, prioritization, and AI-layer views |
-| **Project Website** | Documentation and reference site at [openshield-org.github.io/openshield](https://openshield-org.github.io/openshield/) - blog, rules gallery, architecture, evidence guides, roadmap, and releases |
+| **Project Website** | Documentation and reference site at [owasp.github.io/openshield](https://owasp.github.io/openshield/) - blog, rules gallery, architecture, evidence guides, roadmap, and releases |
 | **Sentinel Integration** | Normalises findings and pushes them into Microsoft Sentinel via a Log Analytics custom table and KQL analytics rules |
 
 ---
@@ -130,7 +130,7 @@ flowchart TD
 |---|---|
 | **Security Dashboard** (Vercel) | `https://openshield-gules.vercel.app` |
 | **REST API** (Render) | `https://openshield-api.onrender.com` |
-| **Project Website** | `https://openshield-org.github.io/openshield/` |
+| **Project Website** | `https://owasp.github.io/openshield/` |
 
 > **Note:** The API is hosted on Render. The dashboard connects automatically on load and shows live data from the PostgreSQL database.
 
@@ -194,7 +194,7 @@ openshield/
 
 ```bash
 # Clone the repo
-git clone https://github.com/openshield-org/openshield.git
+git clone https://github.com/OWASP/openshield.git
 cd openshield
 
 # Install Python dependencies
@@ -318,7 +318,7 @@ Learn OpenShield covers:
 Live Learning Portal: https://openshieldlearn.netlify.app/learn/
 Full documentation, the security rules gallery, architecture guide, evidence guide, and blog are available at the project website:
 
-**[openshield-org.github.io/openshield](https://openshield-org.github.io/openshield/)**
+**[owasp.github.io/openshield](https://owasp.github.io/openshield/)**
 
 ## API Reference
 

website/README.md

@@ -37,17 +37,16 @@ Via the CMS (recommended):
    editorial workflow and are not published until merged.
 3. Saving opens a pull request from `cms/<slug>` against `dev`, signed off
    for DCO. A maintainer reviews and merges it.
-4. When the pull request merges into `dev`, GitHub Actions builds and
-   deploys the site automatically (about 1-2 minutes). The site follows
-   `dev`; `main` only receives release merges.
+4. Merging the pull request into `dev` validates the content but does not
+   publish it. The official site updates only after the change is promoted
+   to `main` through the repository's release process.
 
 ## Deployment pipeline
 
 `.github/workflows/website.yml` builds the site on every pull request targeting
-`dev` or `main`. Every push to `dev` rebuilds and deploys the verified artifact
-to GitHub Pages, so changes to rules, features, documentation, or site code are
-published without maintaining a fragile path list. Manual runs can deploy only
-from `dev`.
+`dev` or `main`. Every push to `main` rebuilds and deploys the verified artifact
+to GitHub Pages, so the official OWASP site reflects release-controlled source.
+Manual runs can deploy only when dispatched from `main`.
 
 GitHub Pages does not support custom response headers. The document-level
 content security policy covers supported directives, but hosting-level headers
@@ -58,7 +57,7 @@ such as `frame-ancestors` require a configurable hosting edge.
 1. In the repository settings, set Pages source to **GitHub Actions**.
 2. Register a GitHub OAuth App for Decap CMS:
    - New OAuth App: https://github.com/settings/applications/new
-   - Homepage URL: `https://openshield-org.github.io/openshield/admin/`
+   - Homepage URL: `https://owasp.github.io/openshield/admin/`
    - Authorization callback URL: `https://api.netlify.com/auth/done`
 3. Add its public Client ID as an Actions repository variable named
    `DECAP_GITHUB_APP_ID`. Do not store a client secret. A missing variable

website/astro.config.mjs

@@ -3,7 +3,7 @@ import sitemap from '@astrojs/sitemap';
 
 // https://astro.build/config
 export default defineConfig({
-  site: 'https://openshield-org.github.io',
+  site: 'https://owasp.github.io',
   base: '/openshield',
   integrations: [sitemap()],
   vite: {

website/public/admin/config.yml

@@ -3,22 +3,22 @@
 # One-time setup (see website/README.md):
 #   1. Register a GitHub OAuth App:
 #        https://github.com/settings/applications/new
-#      Homepage URL:            https://openshield-org.github.io/openshield/admin/
+#      Homepage URL:            https://owasp.github.io/openshield/admin/
 #      Authorization callback: https://api.netlify.com/auth/done
 #   2. Store the public Client ID in the DECAP_GITHUB_APP_ID repository
 #      variable. The deployment pipeline injects it into the built artifact.
 #
 # Publishing flow (compatible with branch protection on dev and main):
 #   author writes in /admin -> editorial_workflow opens a PR from cms/<slug>
-#   against dev, DCO-signed -> maintainer reviews and merges -> GitHub
-#   Actions builds and deploys to Pages automatically.
+#   against dev, DCO-signed -> maintainer reviews and merges -> the change is
+#   published after promotion to main through the repository release process.
 
-site_url: https://openshield-org.github.io/openshield/
-display_url: https://openshield-org.github.io/openshield/
+site_url: https://owasp.github.io/openshield/
+display_url: https://owasp.github.io/openshield/
 
 backend:
   name: github
-  repo: openshield-org/openshield
+  repo: OWASP/openshield
   branch: dev
   auth_type: pkce
   # The deployment build inserts app_id from the repository variable.

website/public/robots.txt

@@ -2,4 +2,4 @@ User-agent: *
 Allow: /
 Disallow: /openshield/admin/
 
-Sitemap: https://openshield-org.github.io/openshield/sitemap-index.xml
+Sitemap: https://owasp.github.io/openshield/sitemap-index.xml

website/scripts/verify-site.mjs

@@ -14,13 +14,19 @@ function filesUnder(directory) {
   });
 }
 
-const sourceFiles = [path.join(root, 'src'), path.join(root, 'public'), path.join(root, 'README.md')]
+const sourceFiles = [
+  path.join(root, 'src'),
+  path.join(root, 'public'),
+  path.join(root, 'README.md'),
+  path.join(root, 'astro.config.mjs'),
+]
   .flatMap((entry) => fs.statSync(entry).isDirectory() ? filesUnder(entry) : [entry])
   .filter((file) => /\.(astro|css|html|js|json|md|mjs|svg|ts|xml|xsl)$/.test(file));
 
 for (const file of sourceFiles) {
   const source = fs.readFileSync(file, 'utf8');
   if (source.includes('\u2014')) failures.push(`${path.relative(root, file)} contains an em dash`);
+  if (source.includes('openshield-org')) failures.push(`${path.relative(root, file)} contains the pre-OWASP repository identity`);
 }
 
 const htmlFiles = filesUnder(dist).filter((file) => file.endsWith('.html') && !file.includes(`${path.sep}admin${path.sep}`));
@@ -82,6 +88,9 @@ if (hasCmsConfig && hasAdminShell) {
 const robotsPath = path.join(dist, 'robots.txt');
 const robots = fs.existsSync(robotsPath) ? fs.readFileSync(robotsPath, 'utf8') : '';
 if (!robots.includes('Disallow: /openshield/admin/')) failures.push('robots.txt does not exclude the CMS route');
+if (!robots.includes('Sitemap: https://owasp.github.io/openshield/sitemap-index.xml')) {
+  failures.push('robots.txt does not advertise the OWASP Pages sitemap');
+}
 
 const jsFiles = filesUnder(path.join(dist, '_astro')).filter((file) => file.endsWith('.js'));
 const largestJs = jsFiles.reduce((largest, file) => Math.max(largest, fs.statSync(file).size), 0);

website/src/components/DemoSection.astro

@@ -20,7 +20,7 @@ const { ruleCount, sampleScan } = repoData;
           <div class="term-card">
           <div class="term-bar"><i></i><i></i><i></i><span class="title">scanner @ prod-01</span><span class="lang">bash</span></div>
           <div class="term" id="termScanner" role="tabpanel" aria-labelledby="tabScanner">
-<span class="ln" style="--i:0"><span class="dim">$</span> git clone https://github.com/openshield-org/openshield.git</span>
+<span class="ln" style="--i:0"><span class="dim">$</span> git clone https://github.com/OWASP/openshield.git</span>
 <span class="ln" style="--i:1"><span class="dim">$</span> python -m scanner.run --subscription <span class="path">prod-01</span></span>
 <span class="ln" style="--i:2"><span class="dim">loading {ruleCount} rule modules from scanner/rules/ ...</span></span>
 <span class="ln" style="--i:3">&nbsp;</span>

website/src/components/Hero.astro

@@ -2,7 +2,7 @@
 import { url } from '../lib/base';
 import { repoData, orbRules, domainOrder } from '../lib/repoData';
 
-const GITHUB = 'https://github.com/openshield-org/openshield';
+const GITHUB = 'https://github.com/OWASP/openshield';
 const { ruleCount, domainCount } = repoData;
 ---
 

website/src/components/JourneySection.astro

@@ -1,6 +1,6 @@
 ---
 import { url } from '../lib/base';
-const GITHUB = 'https://github.com/openshield-org/openshield';
+const GITHUB = 'https://github.com/OWASP/openshield';
 ---
 
 <section class="sec-rule" id="start">

website/src/components/RoadmapSection.astro

@@ -2,7 +2,7 @@
 import { repoData } from '../lib/repoData';
 import { url } from '../lib/base';
 const { ruleCount, domainCount } = repoData;
-const GITHUB = 'https://github.com/openshield-org/openshield';
+const GITHUB = 'https://github.com/OWASP/openshield';
 ---
 
 <section class="sec-rule" id="roadmap">

website/src/content/blog/sentinel-automation.md

@@ -46,7 +46,7 @@ Then push a scan. With no arguments the client defaults to `scanner/output/test_
 python3 sentinel/ingest.py scanner/output/test_findings.json scan-001
 ```
 
-The full walkthrough, including the Sentinel onboarding commands, lives in [docs/sentinel-setup.md](https://github.com/openshield-org/openshield/blob/dev/docs/sentinel-setup.md).
+The full walkthrough, including the Sentinel onboarding commands, lives in [docs/sentinel-setup.md](https://github.com/OWASP/openshield/blob/dev/docs/sentinel-setup.md).
 
 ## Verify with KQL
 

website/src/layouts/Base.astro

@@ -28,7 +28,7 @@ const {
 } = Astro.props;
 
 const canonical = new URL(Astro.url.pathname, Astro.site);
-const GITHUB = 'https://github.com/openshield-org/openshield';
+const GITHUB = 'https://github.com/OWASP/openshield';
 const year = new Date().getFullYear();
 
 /* Structured data: Organization + WebSite on every page. Read by search
@@ -209,7 +209,7 @@ const siteJsonLd = {
     }
   });
 
-  fetch('https://api.github.com/repos/openshield-org/openshield')
+  fetch('https://api.github.com/repos/OWASP/openshield')
     .then((r) => (r.ok ? r.json() : null))
     .then((d) => {
       const el = document.getElementById('starCount');

website/src/lib/repoData.ts

@@ -245,7 +245,7 @@ function releaseHistory(): ReleaseEntry[] {
       return {
         tag: `v${version}`,
         date: match[2],
-        href: references.get(version) ?? `https://github.com/openshield-org/openshield/releases/tag/v${version}`,
+        href: references.get(version) ?? `https://github.com/OWASP/openshield/releases/tag/v${version}`,
       };
     });
 }

website/src/pages/architecture.astro

@@ -3,7 +3,7 @@ import Base from '../layouts/Base.astro';
 import { repoData } from '../lib/repoData';
 import { url } from '../lib/base';
 
-const GITHUB = 'https://github.com/openshield-org/openshield';
+const GITHUB = 'https://github.com/OWASP/openshield';
 const stages = [
   {
     id: 'azure',

website/src/pages/community.astro

@@ -2,7 +2,7 @@
 import Base from '../layouts/Base.astro';
 import { repoData } from '../lib/repoData';
 
-const GITHUB = 'https://github.com/openshield-org/openshield';
+const GITHUB = 'https://github.com/OWASP/openshield';
 const contributors = repoData.contributorActivity;
 
 const LEAD = new Set(['Vishnu Ajith']);

website/src/pages/docs.astro

@@ -4,7 +4,7 @@ import { url } from '../lib/base';
 import { repoData } from '../lib/repoData';
 
 const { docs } = repoData;
-const GITHUB = 'https://github.com/openshield-org/openshield';
+const GITHUB = 'https://github.com/OWASP/openshield';
 
 const sections = ['Guides and references', 'Deployment', 'Validation reports'];
 const grouped = sections
@@ -33,7 +33,7 @@ const grouped = sections
       <ol class="quickstart-steps">
         <li>
           <span class="qs-number">01</span>
-          <div><h3>Clone and create an environment</h3><pre><code>git clone https://github.com/openshield-org/openshield.git
+          <div><h3>Clone and create an environment</h3><pre><code>git clone https://github.com/OWASP/openshield.git
 cd openshield
 python -m venv .venv
 source .venv/bin/activate

website/src/pages/evidence.astro

@@ -2,7 +2,7 @@
 import Base from '../layouts/Base.astro';
 import { repoData } from '../lib/repoData';
 
-const GITHUB = 'https://github.com/openshield-org/openshield';
+const GITHUB = 'https://github.com/OWASP/openshield';
 const maxDomainCount = Math.max(...repoData.domains.map((domain) => domain.count));
 const assurance = [
   ['Continuous integration', '.github/workflows/ci.yml'],

website/src/pages/index.astro

@@ -25,7 +25,7 @@ const appJsonLd = {
   license: 'https://opensource.org/license/mit',
   softwareVersion: repoData.release.tag.replace(/^v/, ''),
   offers: { '@type': 'Offer', price: '0', priceCurrency: 'USD' },
-  sameAs: ['https://github.com/openshield-org/openshield'],
+  sameAs: ['https://github.com/OWASP/openshield'],
 };
 ---