Unsupervised/unsupervised-scheduler
2
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases 19 Wiki Activity

Sign the automated version bump commit in CI #199

Merged
thatguygriff merged 1 commits from ci/sign-version-bump-commit into main 2026-09-05 23:29:51 +00:00
Conversation 1 Commits 1 Files Changed 2
+106 -2
1 Commits
Author SHA1 Message Date
KydoimosandClaude Opus 5 c4b2b5ccff Sign the automated version bump commit in CI
CI / Coding Standards (pull_request) Successful in 23s
Details
CI / Tests (PHP 8.5) (pull_request) Successful in 27s
Details
CI / Tests (PHP 8.2) (pull_request) Successful in 35s
Details
CI / Static Analysis (pull_request) Successful in 39s
Details
CI / Tests (PHP 8.3) (pull_request) Successful in 40s
Details
CI / Tests (PHP 8.1) (pull_request) Successful in 49s
Details
CI / No Debug Code (pull_request) Successful in 35s
Details
CI / Build Plugin Zip (pull_request) Skipped
Details 
main now requires signed commits, and Gitea refuses to merge a pull request
carrying an unsigned one, so the post-release bump PR could not be merged
without disabling the protection first.

The runner now signs that commit with a dedicated release-bot SSH key held as
an organisation Actions secret, trusted by the instance through
[repository.signing] TRUSTED_SSH_KEYS. The key Gitea signs merge commits with
lives on the server and no runner can reach it.

The step fails fast when the secret is missing, unparseable or passphrase
protected, and the commit is re-read before pushing so an unsigned one is
caught here rather than days later at merge time.

Co-Authored-By: Claude Opus 5 <[email protected]>
 2026-09-05 20:25:58 -03:00