Automated release commits are unverified (unsigned)
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 48/100
Research direction
Start by reading src/functions.sh, especially git_config(), then trace the commit and push logic in release-pr/release-pr.sh and prepare-dev/prepare-dev.sh. Confirm how the GitHub REST API should replace those operations and verify that automated release commits from both scripts appear as Verified rather than Unverified.
Written by the indexing model from the issue text.
Description
Problem
Commits created by the release-pr and prepare-dev scripts show as Unverified on GitHub because they use git commit from the CLI, which does not GPG-sign commits.
This affects all repositories using plugin-release-actions, for example:
- pantheon-content-publisher-wordpress — PR #185 — commit
308f68a"Release 1.3.5" - wp-native-php-sessions — PR #344 — commit
88158f3"Release 1.4.6"
Root cause
git_config() in src/functions.sh sets user.email and user.name but does not configure GPG signing. Commits created via git commit in GitHub Actions are never verified unless they are GPG-signed or created through the GitHub API.
Suggested fix
Replace git commit + git push with commits created via the GitHub REST API (POST /repos/{owner}/{repo}/git/commits). Commits created through the API are automatically signed by GitHub's web-flow GPG key and appear as Verified.
This would affect git_config() / commit logic in:
release-pr/release-pr.shprepare-dev/prepare-dev.shsrc/functions.sh
- Dominant language
- Shell
- Stars
- 2
- Forks
- 1
- Avg merge
- 13h 6m
- Merged PRs (30d)
- 3
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from pantheon-systems/plugin-release-actions
-
Difficulty 3/5 1-2 days Newbie friendliness 45/100
-
build-tag-release
Difficulty 3/5 1-2 days Newbie friendliness 35/100
-
enhancement release-pr
Difficulty 3/5 1-2 days Newbie friendliness 35/100
-
enhancement release-pr
Difficulty 4/5 3-5 days Newbie friendliness 25/100
-
documentation
Difficulty 3/5 1-2 days Newbie friendliness 35/100
All issues in pantheon-systems/plugin-release-actions
Similar issues
-
Update Vish to 1.1.5 Openpackage-update
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
oSoWoSo/vOid_Community_repOsitory#144 · 1 comment ·
-
help wanted new command
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
tldr-pages/tldr#24151 ·
-
PacReq: Rune IDE Openpackage request
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
pacstall/pacstall-programs#9402 ·
-
[BUG] ci: the first prefetch-images.sh call runs before shard.txt exists, so it is always a no-op Openbug github-actions
Difficulty 2/5 1-3 hours Newbie friendliness 82/100
-
update-request
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
msys2/MINGW-packages#31768 ·