GitHub Pages URL leads to 404 page

[bendo-eXX]

When navigating to the GitHub Pages deployments and then opening the link https://secvisogram.github.io/csaf-files/, a 404 page is displayed.

The actual page is currently available at:
https://secvisogram.github.io/csaf-files/.well-known/csaf/white/index.html

The GitHub Pages link should be adjusted accordingly so that it points directly to the correct page.

Expected behavior
Opening https://secvisogram.github.io/csaf-files/ should directly display the available page instead of returning a 404 error.

[bendo-eXX]

Problem

Currently, csaf-files/.github/workflows/publish-csaf.yml (via csaf-tools/csaf-action) generates the signed CSAF/VEX documents in the context of the secvisogram/csaf-files repo. The action automatically derives the base URL (canonical_url_prefix) via gh api repos/$GITHUB_REPOSITORY/pages — for csaf-files this resolves to https://secvisogram.github.io/csaf-files/.

However, the documents are ultimately served under https://secvisogram.github.io/ (root, in the secvisogram repo), causing a URL mismatch (self-references, ROLIE feed, etc.). A subsequent URL rewrite in the metadata files would only be a partial fix and could even invalidate OpenPGP signatures/checksums if applied to the actual advisory documents, since the files would be modified after signing.

Live symptom: check.provider.csaf.dev currently reports No CSAF endpoint found with 404s for provider-metadata.json and security.txt.

Solution

Generation + signing of the CSAF structure is moved directly into the secvisogram workflow (csaf-tools/csaf-action runs in the context of secvisogram/secvisogram instead of csaf-files). Since the action derives canonical_url_prefix automatically from the Pages URL of the current repo, the URL is correct from the start (https://secvisogram.github.io/) — no rewrite needed, signatures stay valid.

csaf-files remains a pure source repo for raw advisories/*.json (+ optional .asc signatures), with no publishing/action/gh-pages branch of its own.

Decisions

• Existing triggers (tag push, daily cron, workflow_dispatch) are sufficient — no cross-repo trigger from csaf-files to secvisogram needed. Max delay for new advisories: up to 24h (next cron run).
• publish-csaf.yml, the gh-pages branch, and the associated Pages configuration in csaf-files will be removed entirely (no fallback/legacy operation).