Skip to content

TRU-329: Sign bot commits with the armorsa GPG kit #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jtcrde merged 1 commit into from
Aug 13, 2026
Merged

TRU-329: Sign bot commits with the armorsa GPG kit #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 22 additions & 17 deletions .github/workflows/copy-source-to-repo.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@ name: Copy Source To Repo
# Reusable sync-to-mirror job (port of pipeline-library's
# copy-source-to-repo.yml / infrastructure-modules' sync-customer-modules):
# rsync the paths listed in a path-list file into a target repository,
# commit as the CI bot (SSH-signed, per the armor bot convention), tag with
# commit as the CI bot (GPG-signed with the armorsa CI bot kit), tag with
# the given version, and push over HTTPS with the bot's token.
# Content synced by this workflow should be validated in the SOURCE repo
# before release — the mirror receives it as-is.
Expand Down Expand Up @@ -38,16 +38,17 @@ on:
description: Committer name for the bot commits.
required: false
type: string
default: mdr-autodeploy-dev
committer_email:
description: Committer email for the bot commits (must be verified on the bot account for the Verified badge).
required: false
type: string
default: mdr-autodeploy-dev@armor.com
default: armorsa
secrets:
GIT_TOKEN_BASIC:
required: true
CI_BOT_SSH_KEY:
CI_BOT_GPG_KEY:
required: true
CI_BOT_GPG_KEY_ID:
required: true
CI_BOT_GPG_KEY_PASSPHRASE:
required: true
CI_BOT_GPG_KEY_SUBJECT:
required: true

jobs:
Expand All @@ -60,7 +61,6 @@ jobs:
PATH_LIST_FILE: ${{ inputs.path_list_file }}
SYNC_VERSION: ${{ inputs.version }}
COMMITTER_NAME: ${{ inputs.committer_name }}
COMMITTER_EMAIL: ${{ inputs.committer_email }}
steps:
- name: Checkout code
uses: actions/checkout@v4
Expand All @@ -72,18 +72,23 @@ jobs:
exit 1
fi

- name: Configure SSH commit signing
- name: Import GPG signing key
# The armorsa CI bot kit: key registered on the armorsa account, so
# commits verify. Proven flow carried from the v1 workflows.
env:
SSH_SIGNING_KEY: ${{ secrets.CI_BOT_SSH_KEY }}
GPG_KEY_BASE64: ${{ secrets.CI_BOT_GPG_KEY }}
GPG_PASSPHRASE: ${{ secrets.CI_BOT_GPG_KEY_PASSPHRASE }}
GPG_KEY_ID: ${{ secrets.CI_BOT_GPG_KEY_ID }}
GPG_KEY_SUBJECT: ${{ secrets.CI_BOT_GPG_KEY_SUBJECT }}
run: |
mkdir -p ~/.ssh
echo "$SSH_SIGNING_KEY" > ~/.ssh/signing_key
chmod 600 ~/.ssh/signing_key
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/signing_key
echo "$GPG_KEY_BASE64" | base64 -d | gpg --batch --yes --no-tty --always-trust --import
echo "ENCRYPTION_TEST" | gpg --always-trust --encrypt --recipient "$GPG_KEY_SUBJECT" > temp.encrypted
gpg --batch --yes --no-tty --decrypt --passphrase "$GPG_PASSPHRASE" --pinentry-mode loopback --always-trust temp.encrypted
rm -f temp.encrypted
git config --global user.signingkey "$GPG_KEY_ID"
git config --global commit.gpgsign true
git config --global user.name "$COMMITTER_NAME"
git config --global user.email "$COMMITTER_EMAIL"
git config --global user.email "$GPG_KEY_SUBJECT"

- name: Clone target repository
env:
Expand Down
4 changes: 2 additions & 2 deletions .github/workflows/import-release-content.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -46,12 +46,12 @@ on:
description: Committer name for the import commits.
required: false
type: string
default: mdr-autodeploy-dev
default: armorsa
committer_email:
description: Committer email for the import commits.
required: false
type: string
default: mdr-autodeploy-dev@armor.com
default: ci@armor.com
secrets:
GIT_TOKEN_BASIC:
required: true
Expand Down
44 changes: 24 additions & 20 deletions .github/workflows/update-source-reference.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,12 +3,11 @@ name: Update Source Reference
# Reusable port of pipeline-library's update-source-reference.yml: after a
# package release, rewrite the package's `?ref=` pins in the target repo
# (default: mdr-infrastructure-modules). Minor/patch bumps push directly to
# the default branch as SSH-signed bot commits; major bumps go via a feature
# the default branch as GPG-signed bot commits; major bumps go via a feature
# branch + PR for human review.
#
# Bot identity follows the armor convention: commits are signed with the CI
# bot's SSH key (git gpg.format=ssh) and pushed over HTTPS with the bot's
# token — no GPG keyring, no SSH transport. Hardening carried from the
# Bot identity follows the armor convention: commits are GPG-signed with the
# armorsa CI bot kit and pushed over HTTPS with the bot's token. Hardening carried from the
# TRU-327/342 security review: strict-semver guard on the tag-derived
# version, no shell tracing (consumers are public repos with world-readable
# logs), least-privilege GITHUB_TOKEN.
Expand Down Expand Up @@ -39,16 +38,17 @@ on:
description: Committer name for the bot commits.
required: false
type: string
default: mdr-autodeploy-dev
committer_email:
description: Committer email for the bot commits (must be verified on the bot account for the Verified badge).
required: false
type: string
default: mdr-autodeploy-dev@armor.com
default: armorsa
secrets:
GIT_TOKEN_BASIC:
required: true
CI_BOT_SSH_KEY:
CI_BOT_GPG_KEY:
required: true
CI_BOT_GPG_KEY_ID:
required: true
CI_BOT_GPG_KEY_PASSPHRASE:
required: true
CI_BOT_GPG_KEY_SUBJECT:
required: true

jobs:
Expand All @@ -61,7 +61,6 @@ jobs:
SOURCE_ORG: ${{ inputs.source_org }}
DEFAULT_BRANCH: ${{ inputs.default_branch }}
COMMITTER_NAME: ${{ inputs.committer_name }}
COMMITTER_EMAIL: ${{ inputs.committer_email }}
steps:
- name: Checkout code
uses: actions/checkout@v4
Expand Down Expand Up @@ -98,18 +97,23 @@ jobs:
echo "LATEST_VERSION=$LATEST_VERSION" >> "$GITHUB_ENV"
echo "VERSION_CHANGED=$VERSION_CHANGED" >> "$GITHUB_ENV"

- name: Configure SSH commit signing
- name: Import GPG signing key
# The armorsa CI bot kit: key registered on the armorsa account, so
# commits verify. Proven flow carried from the v1 workflows.
env:
SSH_SIGNING_KEY: ${{ secrets.CI_BOT_SSH_KEY }}
GPG_KEY_BASE64: ${{ secrets.CI_BOT_GPG_KEY }}
GPG_PASSPHRASE: ${{ secrets.CI_BOT_GPG_KEY_PASSPHRASE }}
GPG_KEY_ID: ${{ secrets.CI_BOT_GPG_KEY_ID }}
GPG_KEY_SUBJECT: ${{ secrets.CI_BOT_GPG_KEY_SUBJECT }}
run: |
mkdir -p ~/.ssh
echo "$SSH_SIGNING_KEY" > ~/.ssh/signing_key
chmod 600 ~/.ssh/signing_key
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/signing_key
echo "$GPG_KEY_BASE64" | base64 -d | gpg --batch --yes --no-tty --always-trust --import
echo "ENCRYPTION_TEST" | gpg --always-trust --encrypt --recipient "$GPG_KEY_SUBJECT" > temp.encrypted
gpg --batch --yes --no-tty --decrypt --passphrase "$GPG_PASSPHRASE" --pinentry-mode loopback --always-trust temp.encrypted
rm -f temp.encrypted
git config --global user.signingkey "$GPG_KEY_ID"
git config --global commit.gpgsign true
git config --global user.name "$COMMITTER_NAME"
git config --global user.email "$COMMITTER_EMAIL"
git config --global user.email "$GPG_KEY_SUBJECT"

- name: Update source references
env:
Expand Down
Loading