From 44d53f42cf2a598676f3f653aa94f270fc06a1aa Mon Sep 17 00:00:00 2001 From: jtcrde Date: Thu, 13 Aug 2026 11:14:07 +0800 Subject: [PATCH] TRU-329: Sign bot commits with the armorsa GPG kit (major) --- .github/workflows/copy-source-to-repo.yaml | 39 +++++++++------- .github/workflows/import-release-content.yaml | 4 +- .../workflows/update-source-reference.yaml | 44 ++++++++++--------- 3 files changed, 48 insertions(+), 39 deletions(-) diff --git a/.github/workflows/copy-source-to-repo.yaml b/.github/workflows/copy-source-to-repo.yaml index 15ab370..5aba604 100644 --- a/.github/workflows/copy-source-to-repo.yaml +++ b/.github/workflows/copy-source-to-repo.yaml @@ -3,7 +3,7 @@ name: Copy Source To Repo # Reusable sync-to-mirror job (port of pipeline-library's # copy-source-to-repo.yml / infrastructure-modules' sync-customer-modules): # rsync the paths listed in a path-list file into a target repository, -# commit as the CI bot (SSH-signed, per the armor bot convention), tag with +# commit as the CI bot (GPG-signed with the armorsa CI bot kit), tag with # the given version, and push over HTTPS with the bot's token. # Content synced by this workflow should be validated in the SOURCE repo # before release — the mirror receives it as-is. @@ -38,16 +38,17 @@ on: description: Committer name for the bot commits. required: false type: string - default: mdr-autodeploy-dev - committer_email: - description: Committer email for the bot commits (must be verified on the bot account for the Verified badge). - required: false - type: string - default: mdr-autodeploy-dev@armor.com + default: armorsa secrets: GIT_TOKEN_BASIC: required: true - CI_BOT_SSH_KEY: + CI_BOT_GPG_KEY: + required: true + CI_BOT_GPG_KEY_ID: + required: true + CI_BOT_GPG_KEY_PASSPHRASE: + required: true + CI_BOT_GPG_KEY_SUBJECT: required: true jobs: @@ -60,7 +61,6 @@ jobs: PATH_LIST_FILE: ${{ inputs.path_list_file }} SYNC_VERSION: ${{ inputs.version }} COMMITTER_NAME: ${{ inputs.committer_name }} - COMMITTER_EMAIL: ${{ inputs.committer_email }} steps: - name: Checkout code uses: actions/checkout@v4 @@ -72,18 +72,23 @@ jobs: exit 1 fi - - name: Configure SSH commit signing + - name: Import GPG signing key + # The armorsa CI bot kit: key registered on the armorsa account, so + # commits verify. Proven flow carried from the v1 workflows. env: - SSH_SIGNING_KEY: ${{ secrets.CI_BOT_SSH_KEY }} + GPG_KEY_BASE64: ${{ secrets.CI_BOT_GPG_KEY }} + GPG_PASSPHRASE: ${{ secrets.CI_BOT_GPG_KEY_PASSPHRASE }} + GPG_KEY_ID: ${{ secrets.CI_BOT_GPG_KEY_ID }} + GPG_KEY_SUBJECT: ${{ secrets.CI_BOT_GPG_KEY_SUBJECT }} run: | - mkdir -p ~/.ssh - echo "$SSH_SIGNING_KEY" > ~/.ssh/signing_key - chmod 600 ~/.ssh/signing_key - git config --global gpg.format ssh - git config --global user.signingkey ~/.ssh/signing_key + echo "$GPG_KEY_BASE64" | base64 -d | gpg --batch --yes --no-tty --always-trust --import + echo "ENCRYPTION_TEST" | gpg --always-trust --encrypt --recipient "$GPG_KEY_SUBJECT" > temp.encrypted + gpg --batch --yes --no-tty --decrypt --passphrase "$GPG_PASSPHRASE" --pinentry-mode loopback --always-trust temp.encrypted + rm -f temp.encrypted + git config --global user.signingkey "$GPG_KEY_ID" git config --global commit.gpgsign true git config --global user.name "$COMMITTER_NAME" - git config --global user.email "$COMMITTER_EMAIL" + git config --global user.email "$GPG_KEY_SUBJECT" - name: Clone target repository env: diff --git a/.github/workflows/import-release-content.yaml b/.github/workflows/import-release-content.yaml index 4c1fd5b..95b7e1a 100644 --- a/.github/workflows/import-release-content.yaml +++ b/.github/workflows/import-release-content.yaml @@ -46,12 +46,12 @@ on: description: Committer name for the import commits. required: false type: string - default: mdr-autodeploy-dev + default: armorsa committer_email: description: Committer email for the import commits. required: false type: string - default: mdr-autodeploy-dev@armor.com + default: ci@armor.com secrets: GIT_TOKEN_BASIC: required: true diff --git a/.github/workflows/update-source-reference.yaml b/.github/workflows/update-source-reference.yaml index f87117a..c864f41 100644 --- a/.github/workflows/update-source-reference.yaml +++ b/.github/workflows/update-source-reference.yaml @@ -3,12 +3,11 @@ name: Update Source Reference # Reusable port of pipeline-library's update-source-reference.yml: after a # package release, rewrite the package's `?ref=` pins in the target repo # (default: mdr-infrastructure-modules). Minor/patch bumps push directly to -# the default branch as SSH-signed bot commits; major bumps go via a feature +# the default branch as GPG-signed bot commits; major bumps go via a feature # branch + PR for human review. # -# Bot identity follows the armor convention: commits are signed with the CI -# bot's SSH key (git gpg.format=ssh) and pushed over HTTPS with the bot's -# token — no GPG keyring, no SSH transport. Hardening carried from the +# Bot identity follows the armor convention: commits are GPG-signed with the +# armorsa CI bot kit and pushed over HTTPS with the bot's token. Hardening carried from the # TRU-327/342 security review: strict-semver guard on the tag-derived # version, no shell tracing (consumers are public repos with world-readable # logs), least-privilege GITHUB_TOKEN. @@ -39,16 +38,17 @@ on: description: Committer name for the bot commits. required: false type: string - default: mdr-autodeploy-dev - committer_email: - description: Committer email for the bot commits (must be verified on the bot account for the Verified badge). - required: false - type: string - default: mdr-autodeploy-dev@armor.com + default: armorsa secrets: GIT_TOKEN_BASIC: required: true - CI_BOT_SSH_KEY: + CI_BOT_GPG_KEY: + required: true + CI_BOT_GPG_KEY_ID: + required: true + CI_BOT_GPG_KEY_PASSPHRASE: + required: true + CI_BOT_GPG_KEY_SUBJECT: required: true jobs: @@ -61,7 +61,6 @@ jobs: SOURCE_ORG: ${{ inputs.source_org }} DEFAULT_BRANCH: ${{ inputs.default_branch }} COMMITTER_NAME: ${{ inputs.committer_name }} - COMMITTER_EMAIL: ${{ inputs.committer_email }} steps: - name: Checkout code uses: actions/checkout@v4 @@ -98,18 +97,23 @@ jobs: echo "LATEST_VERSION=$LATEST_VERSION" >> "$GITHUB_ENV" echo "VERSION_CHANGED=$VERSION_CHANGED" >> "$GITHUB_ENV" - - name: Configure SSH commit signing + - name: Import GPG signing key + # The armorsa CI bot kit: key registered on the armorsa account, so + # commits verify. Proven flow carried from the v1 workflows. env: - SSH_SIGNING_KEY: ${{ secrets.CI_BOT_SSH_KEY }} + GPG_KEY_BASE64: ${{ secrets.CI_BOT_GPG_KEY }} + GPG_PASSPHRASE: ${{ secrets.CI_BOT_GPG_KEY_PASSPHRASE }} + GPG_KEY_ID: ${{ secrets.CI_BOT_GPG_KEY_ID }} + GPG_KEY_SUBJECT: ${{ secrets.CI_BOT_GPG_KEY_SUBJECT }} run: | - mkdir -p ~/.ssh - echo "$SSH_SIGNING_KEY" > ~/.ssh/signing_key - chmod 600 ~/.ssh/signing_key - git config --global gpg.format ssh - git config --global user.signingkey ~/.ssh/signing_key + echo "$GPG_KEY_BASE64" | base64 -d | gpg --batch --yes --no-tty --always-trust --import + echo "ENCRYPTION_TEST" | gpg --always-trust --encrypt --recipient "$GPG_KEY_SUBJECT" > temp.encrypted + gpg --batch --yes --no-tty --decrypt --passphrase "$GPG_PASSPHRASE" --pinentry-mode loopback --always-trust temp.encrypted + rm -f temp.encrypted + git config --global user.signingkey "$GPG_KEY_ID" git config --global commit.gpgsign true git config --global user.name "$COMMITTER_NAME" - git config --global user.email "$COMMITTER_EMAIL" + git config --global user.email "$GPG_KEY_SUBJECT" - name: Update source references env: