fix(ci): sign docs-regen commits with dedicated bot GPG key #145

2026-09-10T02:16:27Z

rootiest commented

2026-09-10 02:16:27 +00:00

Problem

CI docs-regen commits (chore(docs): regenerate manual...) never showed as
signed/verified on Gitea, even though [repository.signing] in app.ini had
a valid key. Root cause: that commit is created client-side in the Actions
runner (git commit && git push), and Gitea only signs commits it generates
itself internally (merge button, web editor, wiki) — it never signs a commit
a client pushes to it, regardless of server config.

Separately, the previous commit author Gitea Actions <actions@gitea> was
never a verified email on any Gitea account, so even a valid signature
wouldn't have resolved to a "Verified" badge.

Fix

New dedicated Gitea account fishconfig-bot (verified email
fishconfig-bot@git.rootiest.dev, no login) owns a fresh passphrase-less
ed25519 GPG key (0603CD87750C18FB3604147EFD08763FA41E5534).
Private key stored as the CI_GPG_PRIVATE_KEY repo secret.
The "Commit generated docs" step now imports that key into a scratch
GNUPGHOME, sets user.signingkey/commit.gpgsign, and commits as the
bot identity.

Verified end-to-end against a disposable scratch repo before wiring this in
(bot-signed push → verified: true, reason: "fishconfig-bot / FD08763FA41E5534" via the commit verification API); scratch repo deleted
after.

Separate, not included here

[repository.signing] in app.ini (INITIAL_COMMIT/CRUD_ACTIONS/MERGES/
WIKI_SIG) is still never across the board — that governs Gitea's own
internally-generated commits (PR merge button, web editor, wiki), unrelated
to this fix. The server's own signing key at /data/git/.gnupg was
confirmed present and correctly owned; only the never triggers are
blocking it. Flip those to always (or another trust level) and restart
the gitea container separately, whenever wanted.

## Problem CI docs-regen commits (`chore(docs): regenerate manual...`) never showed as signed/verified on Gitea, even though `[repository.signing]` in app.ini had a valid key. Root cause: that commit is created client-side in the Actions runner (`git commit && git push`), and Gitea only signs commits it generates itself internally (merge button, web editor, wiki) — it never signs a commit a client pushes to it, regardless of server config. Separately, the previous commit author `Gitea Actions <actions@gitea>` was never a verified email on any Gitea account, so even a valid signature wouldn't have resolved to a "Verified" badge. ## Fix - New dedicated Gitea account `fishconfig-bot` (verified email `fishconfig-bot@git.rootiest.dev`, no login) owns a fresh passphrase-less ed25519 GPG key (`0603CD87750C18FB3604147EFD08763FA41E5534`). - Private key stored as the `CI_GPG_PRIVATE_KEY` repo secret. - The "Commit generated docs" step now imports that key into a scratch GNUPGHOME, sets `user.signingkey`/`commit.gpgsign`, and commits as the bot identity. Verified end-to-end against a disposable scratch repo before wiring this in (bot-signed push → `verified: true`, `reason: "fishconfig-bot / FD08763FA41E5534"` via the commit verification API); scratch repo deleted after. ## Separate, not included here `[repository.signing]` in app.ini (`INITIAL_COMMIT`/`CRUD_ACTIONS`/`MERGES`/ `WIKI_SIG`) is still `never` across the board — that governs Gitea's own internally-generated commits (PR merge button, web editor, wiki), unrelated to this fix. The server's own signing key at `/data/git/.gnupg` was confirmed present and correctly owned; only the `never` triggers are blocking it. Flip those to `always` (or another trust level) and restart the `gitea` container separately, whenever wanted.

rootiest added 1 commit 2026-09-10 02:16:28 +00:00

fix(ci): sign docs-regen commits with dedicated bot GPG key a751124b8b

actions@gitea was never a verified email on any Gitea account, so the
CI docs-regen commit (git commit && git push, done client-side in the
runner) could never show as verified regardless of server-side
[repository.signing] config -- Gitea only signs commits it generates
itself (merge button, web editor, wiki), never ones a client pushes.

Import a dedicated passphrase-less key for a new fishconfig-bot
account (verified email, no login) from the CI_GPG_PRIVATE_KEY repo
secret and sign with it instead.

rootiest added the Area/CI Kind/Bug labels 2026-09-10 02:16:55 +00:00

rootiest merged commit 2597b3ccd3 into main

2026-09-10 02:48:52 +00:00

rootiest deleted branch fix/ci-commit-signing

2026-09-10 02:48:52 +00:00

rootiest referenced this pull request

2026-09-10 03:59:26 +00:00

fix(ci): base64-encode the bot GPG key secret #147

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: rootiest/fish-config#145