protect-main requires signed commits, and the build(packaging) pull request's
commit was unsigned: peter-evans/create-pull-request only signs with a bot
token and explicitly not with a PAT, so #82's sign-off alone could not make the
v1.0.1 packaging PR mergeable (#83 was re-created unsigned by "update branch";
#84 was cherry-picked and signed by hand).
The packages job now mints a short-lived token from a release GitHub App
(actions/create-github-app-token, RELEASE_APP_CLIENT_ID variable and
RELEASE_APP_PRIVATE_KEY environment secret, contents + pull requests write on
this repository) and opens the PR with it and sign-commits: true. GitHub signs
the commit, its author is the App's [bot] user (exempt from the DCO check), and
the PR still triggers the required checks. DEPS_PAT is no longer used by the
release workflow; the preflight fails when the App id or key is missing.
RELEASING.md, ADR 0003 and the threat model record the change.
Closes#85
Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Signed-off-by: James Maes <james@kof22.com>
james.maesandClaude Fable 5.1