release: packaging PR commit is unsigned, blocked by protect-main's signed-commits rule #85

New Issue

2026-10-10T17:15:48Z

KofTwentyTwo commented

2026-10-10 17:15:48 +00:00

(Migrated from github.com)

protect-main requires signed commits (required_signatures), and the build(packaging): … pull request the packages job opens is committed by peter-evans/create-pull-request without a signature. #82 added the DCO sign-off, but the v1.0.1 packaging PR still could not merge on its own: GitHub's "update branch" re-created the commit unsigned (#83), and the merged #84 was cherry-picked and signed by hand.

sign-commits: true on the action only signs when the token is a bot token; with a PAT (DEPS_PAT) it explicitly does not sign (action docs, "Commit signature verification for bots"). The fix, matching the KofTwentyTwo standards repository's own release automation: mint a short-lived GitHub App token in the job (actions/create-github-app-token, RELEASE_APP_CLIENT_ID variable + RELEASE_APP_PRIVATE_KEY environment secret) and open the PR with it and sign-commits: true. The commit is then signed by GitHub, authored by the App's [bot] user (exempt from the DCO check), and the PR still triggers the required checks. DEPS_PAT is no longer needed by the release workflow.

Owner steps (one time): create a GitHub App installed only on this repository with Contents and Pull requests write and no ruleset bypass; store its client id as the Actions variable RELEASE_APP_CLIENT_ID and its private key as RELEASE_APP_PRIVATE_KEY in the release environment.

Part of #62. Follows #81.

`protect-main` requires signed commits (`required_signatures`), and the `build(packaging): …` pull request the `packages` job opens is committed by `peter-evans/create-pull-request` without a signature. #82 added the DCO sign-off, but the v1.0.1 packaging PR still could not merge on its own: GitHub's "update branch" re-created the commit unsigned (#83), and the merged #84 was cherry-picked and signed by hand. `sign-commits: true` on the action only signs when the token is a bot token; with a PAT (`DEPS_PAT`) it explicitly does not sign (action docs, "Commit signature verification for bots"). The fix, matching the KofTwentyTwo standards repository's own release automation: mint a short-lived GitHub App token in the job (`actions/create-github-app-token`, `RELEASE_APP_CLIENT_ID` variable + `RELEASE_APP_PRIVATE_KEY` environment secret) and open the PR with it and `sign-commits: true`. The commit is then signed by GitHub, authored by the App's `[bot]` user (exempt from the DCO check), and the PR still triggers the required checks. `DEPS_PAT` is no longer needed by the release workflow. Owner steps (one time): create a GitHub App installed only on this repository with Contents and Pull requests **write** and no ruleset bypass; store its client id as the Actions variable `RELEASE_APP_CLIENT_ID` and its private key as `RELEASE_APP_PRIVATE_KEY` in the `release` environment. Part of #62. Follows #81.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/gclo#85