The Bump Backend dependencies workflow has been red every night for over ten days (since ~Jul 11). Four of its matrix jobs fail consistently: ced.cpp, moss-transcribe.cpp, voice-detect.cpp, rf-detr.cpp.

Root cause

Those four upstreams moved from the mudler org to localai-org, so the GitHub API now answers 301 Moved Permanently for the old slugs. ced.cpp additionally renamed its default branch master → main.

.github/bump_deps.sh fetched the commit SHA with a bare curl -s — no -L, no -f, and no validation of the result. The redirect body was piped straight into sed:

+ sed -i backend/go/ced/Makefile -e 's/CED_VERSION?=.*/CED_VERSION?={
  "message": "Moved Permanently",
  "url": "https://api.github.com/repositories/1275807261/commits/master",
  ...
}/'
sed: -e expression #1, char 32: unterminated `s' command

The loud failure was luck. It only crashed because the JSON contains slashes. An error body without slashes — a rate-limit message, a plain-text error — would have been substituted in as the new pin, silently corrupting the version and shipping it in an auto-merged bump PR.

Changes

• Point the four matrix entries at localai-org/*, and fix ced.cpp's branch to main.
• Harden bump_deps.sh so a bad response can never reach sed: curl -sfL (follow redirects, fail on HTTP errors) plus a ^[0-9a-f]{40}$ guard that aborts with a clear message instead of rewriting the Makefile.
• Refresh the now-stale repo URLs in the backend Makefiles, backend test scripts, backend/index.yaml, README and docs.

gallery/index.yaml is deliberately untouched — those are metadata links that redirect fine, and it is rewritten constantly by bots, so touching it here would only invite conflicts.

Verification

All 25 matrix entries were checked against the live API — every one resolves to a commit SHA, and every referenced Makefile contains the named variable:

OK  ggml-org/llama.cpp@master                LLAMA_VERSION          backend/cpp/llama-cpp/Makefile
...
OK  localai-org/ced.cpp@main                 CED_VERSION            backend/go/ced/Makefile
OK  localai-org/moss-transcribe.cpp@master   MOSS_VERSION           backend/go/moss-transcribe-cpp/Makefile
OK  localai-org/voice-detect.cpp@master      VOICEDETECT_VERSION    backend/go/voice-detect/Makefile
OK  localai-org/rf-detr.cpp@main             RFDETR_VERSION         backend/go/rfdetr-cpp/Makefile

ALL MATRIX ENTRIES RESOLVE

The four previously-failing jobs were then run end to end through the real script against the live API — all exit 0 and write a valid SHA. ced.cpp had a genuine pending bump that the broken job had been missing:

[localai-org/ced.cpp] exit=0
   pin now: CED_VERSION?=db5aae02973a745722d6fbd2157cab1999106777
   message: Changes: .../compare/c04ac14b...db5aae02

The guard was also confirmed to fail closed: pointing the hardened script at a slug that errors exits non-zero and leaves the Makefile untouched.