KydoimosandClaude Opus 5
9c6b4415cd
CI / Coding Standards (pull_request) Successful in 18s
CI / No Debug Code (pull_request) Successful in 4s
CI / Tests (PHP 8.1) (pull_request) Successful in 31s
CI / Static Analysis (pull_request) Successful in 31s
CI / Tests (PHP 8.2) (pull_request) Successful in 49s
CI / Tests (PHP 8.5) (pull_request) Successful in 56s
CI / Tests (PHP 8.3) (pull_request) Successful in 56s
CI / Build Plugin Zip (pull_request) Skipped
main now requires signed commits, and Gitea refuses to merge a pull request carrying an unsigned one, so the post-release bump PR could not be merged without disabling the protection first. The runner now signs that commit with a dedicated release-bot SSH key held as an organisation Actions secret, trusted by the instance through [repository.signing] TRUSTED_SSH_KEYS. The key Gitea signs merge commits with lives on the server and no runner can reach it. The step fails fast when the secret is missing, unparseable or passphrase protected, and the commit is re-read before pushing so an unsigned one is caught here rather than days later at merge time. Co-Authored-By: Claude Opus 5 <[email protected]>