ci(release): sign changesets commits via github-api commit mode - #52
Open
jimmy-phantom wants to merge 1 commit into
Open
ci(release): sign changesets commits via github-api commit mode#52jimmy-phantom wants to merge 1 commit into
jimmy-phantom wants to merge 1 commit into
Conversation
`main` enforces a required-signatures ruleset, but changesets/action defaults to `commitMode: git-cli`, which produces unsigned commits, so every Version Packages PR is unmergeable until its commit is re-signed by hand. `github-api` mode routes commits and tags through the GitHub API, which signs them with GitHub's key and attributes them to the owner of GITHUB_TOKEN. Also narrows the job's `write-all` to the permissions it actually uses: contents and pull-requests for the release PR and tags, id-token for npm provenance. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
mainenforces a required-signatures ruleset, butchangesets/actiondefaults tocommitMode: git-cli, which produces unsigned commits. EveryVersion PackagesPR therefore lands unmergeable and has to be re-signed by hand before it can be merged (as #51 was).Fix
Set
commitMode: github-api. Per the action'saction.yml, that mode routes commits and tags through the GitHub API, where they are "signed using GitHub's GPG key and attributed to the user or app who owns theGITHUB_TOKEN" — i.e.github-actions[bot], Verified.No org-level setup is involved: signing happens server-side with GitHub's key, so the existing repository-scoped
${{ secrets.GITHUB_TOKEN }}is sufficient and no signing secret or GitHub App install is needed.Note that
setupGitUserbecomes a no-op under this mode, since commits no longer go through the git CLI.Also
Narrows the job's
permissions: write-allto what it actually uses:contents: write— release commits, tags, GitHub releasespull-requests: write— creating and updating the version PRid-token: write— required byNPM_CONFIG_PROVENANCE: trueVerification
The next
Version PackagesPR is the real test; this cannot be exercised without a release run. Confirmed statically thatcommitModeexists on the pinnedchangesets/action@v1ref and that the edited workflow parses as intended.🤖 Generated with Claude Code