Sign the automated version bump commit in CI #199

Merged

thatguygriff merged 1 commits from ci/sign-version-bump-commit into main 2026-09-05 23:29:51 +00:00

Conversation 1 Commits 1 Files Changed 2

+106 -2

Kydoimos commented 2026-09-05 23:17:49 +00:00

Member

Copy Link

Copy Source

Signs the commit that bump-version makes after a stable release, so the automated bump PR can be merged into main now that it requires signed commits.

What changed

• .gitea/workflows/release.yml — new Configure signing as Release Bot step in the bump-version job. It materialises secrets.RELEASE_BOT_SIGNING_KEY into $RUNNER_TEMP at 0600, derives the .pub beside it, and switches git to SSH signing (gpg.format ssh). The push step then re-reads the commit and refuses to push if no gpgsig header is present.
• docs/ci.md — new "Signing the version bump commit" section covering the one-time instance setup and its trade-offs.

Setup required before the next release

This is inert — and the job will fail loudly — until both are in place:

1. [repository.signing] TRUSTED_SSH_KEYS in app.ini lists the release-bot public key, and Gitea has been restarted.
2. The organisation Actions secret RELEASE_BOT_SIGNING_KEY holds the matching OpenSSH private key.

No release-bot Gitea account is involved: an account key is only used for signature checking after the web Verify flow, which has no API, so TRUSTED_SSH_KEYS is what makes the signature verify without an account lookup.

Tests

• composer test — 966 tests, 2795 assertions, all passing.
• The signing step was extracted and run against five secret shapes with GIT_CONFIG_GLOBAL/GIT_CONFIG_SYSTEM pinned to /dev/null: a valid OpenSSH key, the same key with CRLF endings, the same key with the trailing newline stripped (all three produce a signed commit), and passphrase-protected and truncated keys (both fail the step with the intended message).

No CHANGELOG.md entry: nothing here is visible to a WordPress site.

Signs the commit that `bump-version` makes after a stable release, so the automated bump PR can be merged into `main` now that it requires signed commits. ## What changed - `.gitea/workflows/release.yml` — new `Configure signing as Release Bot` step in the `bump-version` job. It materialises `secrets.RELEASE_BOT_SIGNING_KEY` into `$RUNNER_TEMP` at 0600, derives the `.pub` beside it, and switches git to SSH signing (`gpg.format ssh`). The push step then re-reads the commit and refuses to push if no `gpgsig` header is present. - `docs/ci.md` — new "Signing the version bump commit" section covering the one-time instance setup and its trade-offs. ## Setup required before the next release This is inert — and the job will fail loudly — until both are in place: 1. `[repository.signing] TRUSTED_SSH_KEYS` in `app.ini` lists the release-bot public key, and Gitea has been restarted. 2. The organisation Actions secret `RELEASE_BOT_SIGNING_KEY` holds the matching OpenSSH private key. No `release-bot` Gitea account is involved: an account key is only used for signature checking after the web *Verify* flow, which has no API, so `TRUSTED_SSH_KEYS` is what makes the signature verify without an account lookup. ## Tests - `composer test` — 966 tests, 2795 assertions, all passing. - The signing step was extracted and run against five secret shapes with `GIT_CONFIG_GLOBAL`/`GIT_CONFIG_SYSTEM` pinned to `/dev/null`: a valid OpenSSH key, the same key with CRLF endings, the same key with the trailing newline stripped (all three produce a signed commit), and passphrase-protected and truncated keys (both fail the step with the intended message). No `CHANGELOG.md` entry: nothing here is visible to a WordPress site.

thatguygriff approved these changes 2026-09-05 23:24:59 +00:00

Kydoimos added 1 commit 2026-09-05 23:26:20 +00:00

Sign the automated version bump commit in CI ... c4b2b5ccff

main now requires signed commits, and Gitea refuses to merge a pull request
carrying an unsigned one, so the post-release bump PR could not be merged
without disabling the protection first.

The runner now signs that commit with a dedicated release-bot SSH key held as
an organisation Actions secret, trusted by the instance through
[repository.signing] TRUSTED_SSH_KEYS. The key Gitea signs merge commits with
lives on the server and no runner can reach it.

The step fails fast when the secret is missing, unparseable or passphrase
protected, and the commit is re-read before pushing so an unsigned one is
caught here rather than days later at merge time.

Co-Authored-By: Claude Opus 5 <[email protected]>

Kydoimos force-pushed ci/sign-version-bump-commit from 9c6b4415cd to c4b2b5ccff 2026-09-05 23:26:20 +00:00 Compare

thatguygriff merged commit 91eb30b222 into main 2026-09-05 23:29:51 +00:00

thatguygriff deleted branch ci/sign-version-bump-commit 2026-09-05 23:29:51 +00:00

Sign in to join this conversation.

Reviewers

No Reviewers

thatguygriff

Labels

Clear labels

bug

Something isn't working

enhancement

Extends an existing feature

feature

New user-facing capability

payments

Billing, Stripe, receipts, reporting

security

Security vulnerability or hardening

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

Kydoimos (Kydoimos) thatguygriff (James Griffin-Allwood)

No Assignees

2 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: Unsupervised/unsupervised-scheduler#199