chore: use github-actions[bot] identity and SSH signing #850
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Contributor
Reviewer's guide (collapsed on small PRs)Reviewer's GuideConfigures the release workflow to use the dedicated github-actions[bot] identity for release commits and enables SSH-based commit signing using a stored signing key secret. Flow diagram for updated release workflow git configuration and SSH signingflowchart TD
Start[Start release job]
Checkout[Checkout repository]
ConfigureGitIdentity["Configure git to use github-actions[bot] identity"]
SetupSSHSigning[Setup SSH signing using SIGNING_KEY]
CreateSignedCommits[Create signed release commits]
End[End job]
Start --> Checkout --> ConfigureGitIdentity --> SetupSSHSigning --> CreateSignedCommits --> End
subgraph ConfigureGitIdentityStep
A1["Set git config user.name to github-actions[bot]"]
A2["Set git config user.email to 41898282+github-actions[bot]@users.noreply.github.com"]
A1 --> A2
end
ConfigureGitIdentity --> ConfigureGitIdentityStep --> SetupSSHSigning
subgraph SetupSSHSigningStep
B1[Create ~/.ssh directory]
B2[Write SIGNING_KEY secret to ~/.ssh/signing_key]
B3[Set chmod 600 on signing_key]
B4[git config gpg.format ssh]
B5[git config user.signingkey ~/.ssh/signing_key]
B6[git config commit.gpgsign true]
B1 --> B2 --> B3 --> B4 --> B5 --> B6
end
SetupSSHSigning --> SetupSSHSigningStep --> CreateSignedCommits
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
📝 Walkthrough🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Comment |
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- When creating the SSH directory, consider also setting its permissions explicitly (e.g.,
chmod 700 ~/.ssh) to match typical SSH security expectations. - If
SIGNING_KEYcan contain newlines, you may want to use a here-doc (cat << 'EOF' > ~/.ssh/signing_key) instead of a simpleechoto ensure the key is written exactly as stored in the secret.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- When creating the SSH directory, consider also setting its permissions explicitly (e.g., `chmod 700 ~/.ssh`) to match typical SSH security expectations.
- If `SIGNING_KEY` can contain newlines, you may want to use a here-doc (`cat << 'EOF' > ~/.ssh/signing_key`) instead of a simple `echo` to ensure the key is written exactly as stored in the secret.
## Individual Comments
### Comment 1
<location> `.github/workflows/release.yml:60-62` </location>
<code_context>
+
+ - name: Setup SSH signing
+ run: |
+ mkdir -p ~/.ssh
+ echo "${{ secrets.SIGNING_KEY }}" > ~/.ssh/signing_key
+ chmod 600 ~/.ssh/signing_key
+ git config gpg.format ssh
+ git config user.signingkey ~/.ssh/signing_key
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Tighten SSH directory permissions and consider cleaning up the signing key after use
The private key stays on disk for the whole job and `~/.ssh` may have default (overly permissive) permissions. I suggest:
1. Explicitly locking down the directory:
```yaml
mkdir -p ~/.ssh
chmod 700 ~/.ssh
```
2. Deleting the key once signing is done (e.g., a final step `rm -f ~/.ssh/signing_key`) to minimize its exposure during the job.
Suggested implementation:
```
- name: Setup SSH signing
run: |
mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo "${{ secrets.SIGNING_KEY }}" > ~/.ssh/signing_key
chmod 600 ~/.ssh/signing_key
git config gpg.format ssh
git config user.signingkey ~/.ssh/signing_key
git config commit.gpgsign true
- name: Determine version and create changelog
id: bumper
- name: Cleanup SSH signing key
if: always()
run: |
rm -f ~/.ssh/signing_key
```
To fully align with the intent ("final step"), the `Cleanup SSH signing key` step should be moved to the end of the job, after all steps that might require signed commits or tags. If there are additional git operations later in this job (e.g., pushing tags/releases), place the cleanup step after the last such step instead of immediately after `Determine version and create changelog`.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
auto-me-bot
bot
added
status: review started
Contributor
Test Results294 tests 294 ✅ 2s ⏱️ Results for commit 6b75b82. ♻️ This comment has been updated with latest results. |
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## dev #850 +/- ##
=======================================
Coverage 98.99% 98.99%
=======================================
Files 11 11
Lines 1292 1292
=======================================
Hits 1279 1279
Misses 13 13 🚀 New features to boost your workflow:
|
auto-me-bot
bot
added
status: merged
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Summary
github-actions[bot]identity for release commits instead ofgithub.actorSIGNING_KEYsecretChanges
Prerequisites
Ensure
SIGNING_KEYsecret is configured in thedeploymentenvironment.Summary by Sourcery
Configure release workflow to use the GitHub Actions bot identity with SSH-signed release commits.
CI:
Summary by CodeRabbit
✏️ Tip: You can customize this high-level summary in your review settings.