chore: move repo to org

.github/workflows/dependabot-automerge.yml

@@ -12,7 +12,7 @@ permissions:
 jobs:
   dependabot-automerge:
     name: Dependabot Automerge
-    if: github.repository == 'zhom/donutbrowser' && github.actor == 'dependabot[bot]'
+    if: github.repository == 'donutbrowser/donutbrowser' && github.actor == 'dependabot[bot]'
     runs-on: ubuntu-latest
     # Never execute pull-request code in this privileged workflow. Auto-merge
     # remains gated by the unprivileged PR checks and branch protection.

.github/workflows/docker-sync.yml

@@ -77,7 +77,7 @@ jobs:
   build-and-push:
     needs: test
     # Forks have no Docker Hub credentials; skip instead of failing there.
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     runs-on: ubuntu-latest
     # A normal build takes 4 to 6 minutes. The emulated arm64 `npm install`
     # hung four times since August and burned the 6-hour default each time.

.github/workflows/i18n-review.yml

@@ -36,7 +36,7 @@ env:
 jobs:
   review:
     if: >-
-      github.repository == 'zhom/donutbrowser' &&
+      github.repository == 'donutbrowser/donutbrowser' &&
       (github.event_name == 'push' ||
        (github.event.pull_request.draft == false &&
         github.event.pull_request.user.type != 'Bot'))

.github/workflows/issue-validation.yml

@@ -30,7 +30,7 @@ jobs:
   # they open quick tracking issues without the template on purpose.
   check-issue:
     if: >-
-      github.repository == 'zhom/donutbrowser' &&
+      github.repository == 'donutbrowser/donutbrowser' &&
       github.event_name == 'issues' &&
       github.event.issue.author_association != 'OWNER' &&
       github.event.issue.author_association != 'MEMBER'
@@ -246,7 +246,7 @@ jobs:
     # Also runs when the check was skipped (maintainers' issues) or degraded,
     # but never answers an issue the check closed or deleted.
     if: >-
-      github.repository == 'zhom/donutbrowser' &&
+      github.repository == 'donutbrowser/donutbrowser' &&
       github.event_name == 'issues' &&
       !cancelled() &&
       needs.check-issue.outputs.action != 'close' &&
@@ -382,7 +382,7 @@ jobs:
             "clear", "reasonable", "well-thought-out", etc.
           - AI-generated / template-violating report: report doesn't follow the
             template, may cite "official documentation" via context7, deepwiki, or any
-            non-`donutbrowser.com` / non-`github.com/zhom` URL. The only authoritative
+            non-`donutbrowser.com` / non-`github.com/donutbrowser` URL. The only authoritative
             sources are this GitHub repo and donutbrowser.com.
           - Speculation about internals: never write a "Possible cause" / "Likely
             cause" / "Root cause" section. Never cite internal file paths or line
@@ -563,7 +563,7 @@ jobs:
           The triage classification (`triage.classification`) determines the response shape:
 
           - `bug-in-scope`: ask for what is missing using the user's reported OS log path. Be concrete about how to obtain logs.
-          - `bug-template-violation` or `automated-content`: ask for the missing details in the comment (Operating System, Donut Browser version, Wayfern version, Steps to reproduce, logs). Never ask the user to open a new issue or to refile. If they cited "documentation" from any non-`donutbrowser.com`/non-`github.com/zhom` URL (e.g. context7, deepwiki), gently note that those are AI-generated third-party summaries and the only authoritative sources are this repo and donutbrowser.com.
+          - `bug-template-violation` or `automated-content`: ask for the missing details in the comment (Operating System, Donut Browser version, Wayfern version, Steps to reproduce, logs). Never ask the user to open a new issue or to refile. If they cited "documentation" from any non-`donutbrowser.com`/non-`github.com/donutbrowser` URL (e.g. context7, deepwiki), gently note that those are AI-generated third-party summaries and the only authoritative sources are this repo and donutbrowser.com.
           - `feature-request`: one neutral sentence acknowledging, then ask only what is genuinely needed (concrete use case, whether a workaround would suffice). Do NOT validate.
           - `fork-request`: one neutral sentence acknowledging the request. Note that this would substantially increase support burden and the maintainer evaluates such requests on a case-by-case basis. Ask whether the alternative fork supports all platforms the user uses (macOS / Windows / Linux). No "clear enhancement" language.
           - `regression`: do NOT call known/expected. Ask which exact previous version was the last working one, what changed in the user's environment between then and now, and the specific delta in symptoms.
@@ -685,7 +685,7 @@ jobs:
           fi
 
   analyze-pr:
-    if: github.repository == 'zhom/donutbrowser' && github.event_name == 'pull_request_target' && github.actor != 'dependabot[bot]'
+    if: github.repository == 'donutbrowser/donutbrowser' && github.event_name == 'pull_request_target' && github.actor != 'dependabot[bot]'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     permissions:
@@ -867,7 +867,7 @@ jobs:
 
   opencode-command:
     if: |
-      github.repository == 'zhom/donutbrowser' &&
+      github.repository == 'donutbrowser/donutbrowser' &&
       (github.event_name == 'issue_comment' || github.event_name == 'pull_request_review_comment') &&
       (github.event.comment.author_association == 'OWNER' ||
        github.event.comment.author_association == 'MEMBER' ||

.github/workflows/notify-telegram.yml

@@ -27,7 +27,7 @@ permissions:
 jobs:
   notify:
     if: >
-      github.repository == 'zhom/donutbrowser' &&
+      github.repository == 'donutbrowser/donutbrowser' &&
       (github.event_name == 'workflow_dispatch' ||
        github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-latest

.github/workflows/pr-ai-policy.yml

@@ -29,7 +29,7 @@ jobs:
     # template, and closing them would silently stop dependency updates and
     # break dependabot-automerge.yml.
     if: >-
-      github.repository == 'zhom/donutbrowser' &&
+      github.repository == 'donutbrowser/donutbrowser' &&
       github.event.pull_request.state == 'open' &&
       github.event.pull_request.user.type != 'Bot'
     runs-on: ubuntu-latest
@@ -174,7 +174,7 @@ jobs:
                   detail = ' '.join(str(v.get('detail') or v.get('rule') or 'policy violation').split())
                   parts.append(f"- {detail[:300]}")
               parts.append('')
-              parts.append('The policy ([CONTRIBUTING.md](https://github.com/zhom/donutbrowser/blob/main/CONTRIBUTING.md#ai-policy)):')
+              parts.append('The policy ([CONTRIBUTING.md](https://github.com/donutbrowser/donutbrowser/blob/main/CONTRIBUTING.md#ai-policy)):')
               parts.append('')
               parts.append('- Every pull request states, explicitly, whether AI was used. Tick exactly one box in the AI usage section. Neither, both, or a deleted section closes the PR.')
               parts.append('- No commit may be co-authored by an AI. Strip `Co-Authored-By:` and "Generated with ..." trailers before pushing. `git commit --amend` or a rebase is enough.')

.github/workflows/publish-repos.yml

@@ -18,7 +18,7 @@ permissions:
 jobs:
   publish-repos:
     if: >
-      github.repository == 'zhom/donutbrowser' &&
+      github.repository == 'donutbrowser/donutbrowser' &&
       (github.event_name == 'workflow_dispatch' ||
        github.event.workflow_run.conclusion == 'success')
     runs-on: ubuntu-latest

.github/workflows/publish-sidecars.yml

@@ -63,7 +63,7 @@ jobs:
   build:
     name: Build donut-proxy (${{ matrix.target }})
     # Forks have no R2 credentials; skip instead of failing there.
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     runs-on: ${{ matrix.platform }}
     # Builds take 13 to 23 minutes; this only stops a hung runner.
     timeout-minutes: 90

.github/workflows/release-notes-generator.yml

@@ -14,7 +14,7 @@ jobs:
   generate-release-notes:
     runs-on: ubuntu-latest
     timeout-minutes: 15
-    if: github.repository == 'zhom/donutbrowser' && github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'v')
+    if: github.repository == 'donutbrowser/donutbrowser' && github.event.workflow_run.conclusion == 'success' && startsWith(github.event.workflow_run.head_branch, 'v')
 
     steps:
       - name: Checkout repository

.github/workflows/release.yml

@@ -18,7 +18,7 @@ env:
 
 jobs:
   security-scan:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     name: Security Vulnerability Scan
     uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
     with:
@@ -34,21 +34,21 @@ jobs:
       actions: read
 
   lint-js:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     name: Lint JavaScript/TypeScript
     uses: ./.github/workflows/lint-js.yml
     permissions:
       contents: read
 
   lint-rust:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     name: Lint Rust
     uses: ./.github/workflows/lint-rs.yml
     permissions:
       contents: read
 
   codeql:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     name: CodeQL
     uses: ./.github/workflows/codeql.yml
     permissions:
@@ -58,14 +58,14 @@ jobs:
       actions: read
 
   spellcheck:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     name: Spell Check
     uses: ./.github/workflows/spellcheck.yml
     permissions:
       contents: read
 
   release:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     needs: [security-scan, lint-js, lint-rust, codeql, spellcheck]
     permissions:
       contents: write
@@ -286,7 +286,7 @@ jobs:
   # The Flatpak and the Snap, repackaged from this release's .deb and attached
   # to it before the checksums are taken, so SHA256SUMS.txt covers them.
   linux-packages:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     needs: [release]
     uses: ./.github/workflows/linux-packages.yml
     permissions:
@@ -296,7 +296,7 @@ jobs:
 
   checksums:
     # A failed Flatpak or Snap never holds back the checksums.
-    if: ${{ !cancelled() && github.repository == 'zhom/donutbrowser' && needs.release.result == 'success' }}
+    if: ${{ !cancelled() && github.repository == 'donutbrowser/donutbrowser' && needs.release.result == 'success' }}
     needs: [release, linux-packages]
     runs-on: ubuntu-latest
     permissions:
@@ -316,7 +316,7 @@ jobs:
           gh release upload "$TAG" SHA256SUMS.txt --clobber --repo "$GITHUB_REPOSITORY"
 
   changelog:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     needs: [release]
     runs-on: ubuntu-latest
     permissions:
@@ -412,7 +412,7 @@ jobs:
           TAG: ${{ github.ref_name }}
         run: |
           VERSION="${TAG#v}"
-          BASE="https://github.com/zhom/donutbrowser/releases/download/${TAG}"
+          BASE="https://github.com/donutbrowser/donutbrowser/releases/download/${TAG}"
 
           # Generate the new install section between markers
           cat > /tmp/install-links.md << LINKS
@@ -483,7 +483,7 @@ jobs:
           gh release edit "$TAG" --notes-file /tmp/release-changelog.md
 
   notify-discord:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     needs: [release, changelog]
     runs-on: ubuntu-latest
     steps:
@@ -561,7 +561,7 @@ jobs:
           curl -fsSL -H "Content-Type: application/json" -d "$PAYLOAD" "$DISCORD_WEBHOOK_URL"
 
   deploy-website:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     needs: [release]
     runs-on: ubuntu-latest
     steps:
@@ -571,7 +571,7 @@ jobs:
         run: curl -fsSL -X POST "$DEPLOYMENT_HOOK"
 
   docker:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     needs: [release]
     uses: ./.github/workflows/docker-sync.yml
     with:
@@ -581,7 +581,7 @@ jobs:
       DOCKERHUB_TOKEN: ${{ secrets.DOCKERHUB_TOKEN }}
 
   update-flake:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     needs: [release, changelog]
     runs-on: ubuntu-latest
     permissions:
@@ -600,8 +600,8 @@ jobs:
           VERSION="${TAG#v}"
           echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
 
-          AMD64_URL="https://github.com/zhom/donutbrowser/releases/download/${TAG}/Donut_${VERSION}_amd64.AppImage"
-          AARCH64_URL="https://github.com/zhom/donutbrowser/releases/download/${TAG}/Donut_${VERSION}_aarch64.AppImage"
+          AMD64_URL="https://github.com/donutbrowser/donutbrowser/releases/download/${TAG}/Donut_${VERSION}_amd64.AppImage"
+          AARCH64_URL="https://github.com/donutbrowser/donutbrowser/releases/download/${TAG}/Donut_${VERSION}_aarch64.AppImage"
 
           echo "Downloading x86_64 AppImage..."
           curl -fsSL -o /tmp/amd64.AppImage "$AMD64_URL" || { echo "x86_64 AppImage not found"; exit 1; }
@@ -627,11 +627,11 @@ jobs:
           sed -i "s/releaseVersion = \"[^\"]*\"/releaseVersion = \"${VERSION}\"/" flake.nix
 
           # Update x86_64 URL and hash
-          sed -i "s|url = \"https://github.com/zhom/donutbrowser/releases/download/v[^\"]*_amd64.AppImage\"|url = \"${AMD64_URL}\"|" flake.nix
+          sed -i "s|url = \"https://github.com/donutbrowser/donutbrowser/releases/download/v[^\"]*_amd64.AppImage\"|url = \"${AMD64_URL}\"|" flake.nix
           sed -i "/amd64.AppImage/{ n; s|hash = \"[^\"]*\"|hash = \"${AMD64_HASH}\"|; }" flake.nix
 
           # Update aarch64 URL and hash
-          sed -i "s|url = \"https://github.com/zhom/donutbrowser/releases/download/v[^\"]*_aarch64.AppImage\"|url = \"${AARCH64_URL}\"|" flake.nix
+          sed -i "s|url = \"https://github.com/donutbrowser/donutbrowser/releases/download/v[^\"]*_aarch64.AppImage\"|url = \"${AARCH64_URL}\"|" flake.nix
           sed -i "/aarch64.AppImage/{ n; s|hash = \"[^\"]*\"|hash = \"${AARCH64_HASH}\"|; }" flake.nix
 
           echo "Updated flake.nix:"

.github/workflows/rolling-release.yml

@@ -25,7 +25,7 @@ env:
 
 jobs:
   security-scan:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     name: Security Vulnerability Scan
     uses: "google/osv-scanner-action/.github/workflows/osv-scanner-reusable.yml@a345acffa64b0eaede81a3d9aae6141214d9c8fc" # v2.6.0
     with:
@@ -41,21 +41,21 @@ jobs:
       actions: read
 
   lint-js:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     name: Lint JavaScript/TypeScript
     uses: ./.github/workflows/lint-js.yml
     permissions:
       contents: read
 
   lint-rust:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     name: Lint Rust
     uses: ./.github/workflows/lint-rs.yml
     permissions:
       contents: read
 
   codeql:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     name: CodeQL
     uses: ./.github/workflows/codeql.yml
     permissions:
@@ -65,14 +65,14 @@ jobs:
       actions: read
 
   spellcheck:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     name: Spell Check
     uses: ./.github/workflows/spellcheck.yml
     permissions:
       contents: read
 
   rolling-release:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     needs: [security-scan, lint-js, lint-rust, codeql, spellcheck]
     permissions:
       contents: write
@@ -301,7 +301,7 @@ jobs:
   # The Flatpak and the Snap, repackaged from this build's .deb and attached to
   # its release before the nightly is assembled from it.
   nightly-tag:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     needs: [rolling-release]
     runs-on: ubuntu-latest
     timeout-minutes: 5
@@ -327,7 +327,7 @@ jobs:
   update-nightly-release:
     # A failed Flatpak or Snap never holds back the nightly; it only goes out
     # without them.
-    if: ${{ !cancelled() && github.repository == 'zhom/donutbrowser' && needs.rolling-release.result == 'success' }}
+    if: ${{ !cancelled() && github.repository == 'donutbrowser/donutbrowser' && needs.rolling-release.result == 'success' }}
     needs: [rolling-release, linux-packages]
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -447,7 +447,7 @@ jobs:
             --prerelease
 
   deploy-website:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     needs: [update-nightly-release]
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -458,7 +458,7 @@ jobs:
         run: curl -fsSL -X POST "$DEPLOYMENT_HOOK"
 
   notify-discord:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     needs: [update-nightly-release]
     runs-on: ubuntu-latest
     timeout-minutes: 10

.github/workflows/stale.yml

@@ -6,7 +6,7 @@ on:
 
 jobs:
   stale:
-    if: github.repository == 'zhom/donutbrowser'
+    if: github.repository == 'donutbrowser/donutbrowser'
     runs-on: ubuntu-latest
     timeout-minutes: 10
     permissions: