Sign the automated version bump commit in CI #16

Merged

thatguygriff merged 1 commits from ci/sign-version-bump-commit into main

2026-09-12 15:03:42 +00:00

Author	SHA1	Message	Date
KydoimosandClaude Opus 5	0a196454d1	Sign the automated version bump commit Publish / Build and push (pull_request) Successful in 3s Details Publish / Move the working version on (pull_request) Skipped Details CI / Typecheck, test, build (pull_request) Successful in 15s Details main requires signed commits, so the pull request the bump job opens after a release cannot be merged while the commit in it is unsigned. The key the server signs merge commits with is not reachable from a runner, so the job signs with a dedicated release-bot SSH key that the instance trusts through TRUSTED_SSH_KEYS — no bot account, because an account key is only consulted after the web Verify flow and that flow has no API. Inert until the key is trusted and RELEASE_BOT_SIGNING_KEY is set, and loudly so: the step checks the secret and ssh-keygen before it starts, runs the key through ssh-keygen -y so a truncated or re-wrapped one is caught as itself rather than as "gpg failed to sign the data", and the commit is re-read for a gpgsig header before it is pushed. Co-Authored-By: Claude Opus 5 <[email protected]>	2026-09-12 11:58:47 -03:00

Author

SHA1

Message

Date

KydoimosandClaude Opus 5

0a196454d1

Sign the automated version bump commit

Publish / Build and push (pull_request) Successful in 3s

Details

Publish / Move the working version on (pull_request) Skipped

Details

CI / Typecheck, test, build (pull_request) Successful in 15s

Details

main requires signed commits, so the pull request the bump job opens after a
release cannot be merged while the commit in it is unsigned. The key the server
signs merge commits with is not reachable from a runner, so the job signs with a
dedicated release-bot SSH key that the instance trusts through
TRUSTED_SSH_KEYS — no bot account, because an account key is only consulted
after the web Verify flow and that flow has no API.

Inert until the key is trusted and RELEASE_BOT_SIGNING_KEY is set, and loudly so:
the step checks the secret and ssh-keygen before it starts, runs the key through
ssh-keygen -y so a truncated or re-wrapped one is caught as itself rather than as
"gpg failed to sign the data", and the commit is re-read for a gpgsig header
before it is pushed.

Co-Authored-By: Claude Opus 5 <[email protected]>

2026-09-12 11:58:47 -03:00