build: pack the SQL from the crudylabs/pgmorbac GitHub release

README.md

@@ -31,7 +31,7 @@ adds permission checks, the RLS session context and management routes.
 
 The package version is the extension version. Building the package downloads
 that version's release from
-[crudy/pgmorbac](https://git.villains.fr/crudy/pgmorbac/releases), checks the
+[crudylabs/pgmorbac](https://github.com/crudylabs/pgmorbac/releases), checks the
 Ed25519-signed manifest against the pinned `release-key.pub.pem` and the zip
 against the manifest's sha256, and only then extracts the SQL. The extension
 source lives in [pgmorbac](https://github.com/crudylabs/pgmorbac); this repository

scripts/fetch-release.mjs

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 // prepack: fills sql/ from the signed pgmorbac release whose version matches
-// package.json. The release comes from the crudy/pgmorbac Gitea releases, or
+// package.json. The release comes from the crudylabs/pgmorbac GitHub releases, or
 // from a local directory of release files (PGMORBAC_DIST_DIR, the dist/ that
 // the extension's build-dist.mjs writes). Either way it must verify against the
 // pinned release-key.pub.pem before anything is written.
@@ -10,7 +10,7 @@ import { fileURLToPath } from 'node:url';
 import { extractSql, releaseFiles, verifyRelease } from './release.mjs';
 
 const root = join(dirname(fileURLToPath(import.meta.url)), '..');
-const RELEASES = 'https://git.villains.fr/crudy/pgmorbac/releases/download';
+const RELEASES = 'https://github.com/crudylabs/pgmorbac/releases/download';
 
 const { version } = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
 const files = releaseFiles(version);