From a751124b8beefd20db30219028df8e47fbdeed0a Mon Sep 17 00:00:00 2001 From: Rootiest Date: Wed, 9 Sep 2026 22:16:13 -0400 Subject: [PATCH] fix(ci): sign docs-regen commits with dedicated bot GPG key actions@gitea was never a verified email on any Gitea account, so the CI docs-regen commit (git commit && git push, done client-side in the runner) could never show as verified regardless of server-side [repository.signing] config -- Gitea only signs commits it generates itself (merge button, web editor, wiki), never ones a client pushes. Import a dedicated passphrase-less key for a new fishconfig-bot account (verified email, no login) from the CI_GPG_PRIVATE_KEY repo secret and sign with it instead. --- .github/workflows/ci.yml | 19 +++++++++++++++++-- 1 file changed, 17 insertions(+), 2 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 2ddd174..e3bdeb4 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -127,9 +127,24 @@ jobs: --commit-dirty=true - name: Commit generated docs + env: + BOT_GPG_KEY: ${{ secrets.CI_GPG_PRIVATE_KEY }} run: | - git config user.name "Gitea Actions" - git config user.email "actions@gitea" + # actions@gitea was never a verified email on any account, so + # these commits could never show as signed/verified regardless + # of server config. fishconfig-bot is a dedicated Gitea account + # (verified email, no login) that owns this key; the private + # key lives only in the CI_GPG_PRIVATE_KEY repo secret. + export GNUPGHOME="$(mktemp -d)" + chmod 700 "$GNUPGHOME" + echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf" + echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf" + command -v gpg >/dev/null || sudo apt-get install -y --no-install-recommends gnupg + echo "$BOT_GPG_KEY" | gpg --batch --import + git config user.name "Gitea Actions Bot" + git config user.email "fishconfig-bot@git.rootiest.dev" + git config user.signingkey 0603CD87750C18FB3604147EFD08763FA41E5534 + git config commit.gpgsign true git add docs/fish-config.md docs/fish-config.1 conf.d/__fish_config_op_registry.fish git diff --cached --quiet && echo "No changes to commit" && exit 0 git commit -m "chore(docs): regenerate manual, man page, and component registry" -- 2.54.0