Deploy scripts move to the private bops-secrets

README.md

@@ -254,7 +254,7 @@ To try your changes in the app, run `npm run app:build`. It makes an unsigned de
 
 Orgo's releases are built from a version tag of this repository by a workflow in Orgo's private repository, which holds the signing and notarization secrets. It builds, signs and notarizes on a GitHub Mac, checks that Gatekeeper accepts the app, and attaches the DMG and zip to the release here with that version's notes from `docs/releases/`. This repository holds no secrets.
 
-Bops updates itself. `scripts/download-publish.sh` puts the release's DMG and its zip (`Bops-<version>-arm64-mac.zip`) on bops.bot and writes `/download/latest.json`, which the app checks at launch and every hour. Next to `version` and `notes`, that file has the keys Electron's updater reads, `currentRelease` and `releases` (each with `updateTo.url`, the zip). A newer version downloads in the background, unless the user turned off **Settings → This Mac → Download updates automatically**, and installs when the user clicks Restart or quits Bops. macOS installs it only when the zip's app is signed by the same team (A47GG9FV27) with the same bundle id (`ai.orgo.bops`), so `release.sh` checks the zip for that. A copy opened from the DMG or Downloads, or in a folder the user can't write, can't replace itself and sends the user to bops.bot instead. Versions 0.0.28 and older don't update themselves: their users download the next version from bops.bot once. To try an update on your Mac, run a build with `BOPS_UPDATE_FEED=http://127.0.0.1:<port>/latest.json` (only this Mac's addresses are taken), from a local server holding that file and the zip.
+Bops updates itself. With each release, Orgo's `download-publish.sh` (in the same private repository) puts the release's DMG and its zip (`Bops-<version>-arm64-mac.zip`) on bops.bot and writes `/download/latest.json`, which the app checks at launch and every hour. Next to `version` and `notes`, that file has the keys Electron's updater reads, `currentRelease` and `releases` (each with `updateTo.url`, the zip). A newer version downloads in the background, unless the user turned off **Settings → This Mac → Download updates automatically**, and installs when the user clicks Restart or quits Bops. macOS installs it only when the zip's app is signed by the same team (A47GG9FV27) with the same bundle id (`ai.orgo.bops`), so `release.sh` checks the zip for that. A copy opened from the DMG or Downloads, or in a folder the user can't write, can't replace itself and sends the user to bops.bot instead. Versions 0.0.28 and older don't update themselves: their users download the next version from bops.bot once. To try an update on your Mac, run a build with `BOPS_UPDATE_FEED=http://127.0.0.1:<port>/latest.json` (only this Mac's addresses are taken), from a local server holding that file and the zip.
 
 The app runs with the hardened runtime and three entitlements (`build/entitlements.mac.plist`): JIT for Electron, the microphone for calls, and Apple Events so Full access can use your apps. Bops asks macOS for Screen Recording, the microphone and notifications, and Full access also needs Full Disk Access and Automation. Bops isn't on the Mac App Store because its sandbox would stop Bops from running its own server, starting Codex and Chrome for the bots, and driving other apps.
 

cloud/deploy/bops-cloud.service

@@ -8,7 +8,8 @@ User=bops
 Group=bops
 WorkingDirectory=/opt/bops
 # Provider keys, the database URL and BOPS_CLOUD_SECRET (from Orgo's prod/bops-secrets.env), plus the
-# public settings (prod/bops-public.env). scripts/cloud-deploy.sh writes it, mode 0640 root:bops.
+# public settings (prod/bops-public.env). Orgo's cloud-deploy.sh (OrgoAI/bops-secrets) writes it, mode
+# 0640 root:bops.
 EnvironmentFile=/etc/bops-cloud/env
 ExecStart=/usr/local/bin/node /opt/bops/cloud/server.ts
 Restart=always

cloud/deploy/install.sh

@@ -2,7 +2,8 @@
 # Sets up Bops Cloud on orgo-web's production box (Ubuntu 24.04), as root, next to orgo-web. Safe to
 # run again. Run on the box:
 #   bash /opt/bops/cloud/deploy/install.sh
-# Then scripts/cloud-deploy.sh (on a laptop) puts the code, the settings and the relay binary here.
+# Then Orgo's cloud-deploy.sh (OrgoAI/bops-secrets; on a laptop, from a bops checkout) puts the code,
+# the settings and the relay binary here.
 #
 # What it adds, and nothing else:
 # - Node 24 (official build, checksum checked) under /usr/local/lib/nodejs.
@@ -45,7 +46,7 @@ install -d -m 0750 -o root -g bops /etc/bops-cloud
 install -d -m 0750 -o root -g orgo-relay /etc/orgo-relay
 install -d -m 0750 -o orgo-relay -g orgo-relay /etc/orgo-relay/tls
 
-# The services: installed and enabled; scripts/cloud-deploy.sh starts them once code and settings are in.
+# The services: installed and enabled; Orgo's cloud-deploy.sh starts them once code and settings are in.
 install -m 0644 "$here/bops-cloud.service" "$here/orgo-relay-rendezvous.service" "$here/orgo-relay-cert.service" "$here/orgo-relay-cert.timer" /etc/systemd/system/
 install -m 0755 "$here/orgo-relay-cert-sync.sh" /usr/local/sbin/orgo-relay-cert-sync
 systemctl daemon-reload
@@ -71,4 +72,4 @@ else
   fi
 fi
 
-echo "Box ready (Node $(/usr/local/bin/node --version)). Now run scripts/cloud-deploy.sh."
+echo "Box ready (Node $(/usr/local/bin/node --version)). Now run Orgo's cloud-deploy.sh (OrgoAI/bops-secrets) from a bops checkout."

desktop/main.cjs

@@ -1208,7 +1208,7 @@ ipcMain.handle("mac-show-main", () => showMain());
 
 /*
  * New versions. Bops gets them itself: it asks bops.bot for the newest release (download/latest.json,
- * written by scripts/download-publish.sh) at launch and every hour, and when there's a newer one than
+ * written by Orgo's download-publish.sh) at launch and every hour, and when there's a newer one than
  * this app it's downloaded in the app (desktop/updates.cjs). With "Download updates automatically" on
  * (Settings → This Mac, the default) that happens quietly; with it off the page's notice
  * (components/app/update-notice.tsx) says it's out and the user clicks Download. Either way, once it's

docs/releases/README.md

@@ -7,7 +7,7 @@ Between releases, the lines collect in `next.md`: add one when something users w
 Each version's lines become:
 
 - its GitHub release notes, with the line on signing and notarization under them;
-- "What's new" in the app's notice that a newer Bops is out or ready to install, and on bops.bot's download card (both read `/download/latest.json`, which `scripts/download-publish.sh` writes).
+- "What's new" in the app's notice that a newer Bops is out or ready to install, and on bops.bot's download card (both read `/download/latest.json`, which Orgo's `scripts/download-publish.sh`, also in OrgoAI/bops-secrets, writes).
 
 Write for the people using Bops: what they can do now, or what works better. Plain words: no branch names, pull requests, file paths or settings, and no names of people.