fix(ci): re-add changelog and git plugins with signed commit support#375
Conversation
✅ Deploy Preview for devsydev canceled.
|
|
Warning Rate limit exceeded
You’ve run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After the wait time has elapsed, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout. Please see our FAQ for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe PR updates the semantic-release workflow by adding git credential persistence and identity configuration to the GitHub Actions checkout step, then updates ChangesSemantic Release Automation
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Suggested labels
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/semantic-release.yml:
- Around line 35-38: The workflow currently sets a custom Git identity via the
git config commands that set user.name and user.email, which prevents GitHub's
bot signature verification; either remove those git config lines so
semantic-release uses the GitHub App identity (allowing automatic verified
commits), or keep them but implement explicit commit signing by importing a
GPG/SSH key and configuring commit.gpgsign and user.signingkey in the workflow
before committing so created commits are verified; update the semantic-release
job accordingly and ensure the chosen approach satisfies branch protection rules
for verified commits.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro
Run ID: b997bb89-fd9a-4b9e-a2b0-73e3428a925e
📒 Files selected for processing (2)
.github/workflows/semantic-release.yml.releaserc.json
| - name: Configure git identity | ||
| run: | | ||
| git config user.name "devsy-bot[bot]" | ||
| git config user.email "198134133+devsy-bot[bot]@users.noreply.github.com" |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
# First, let's check if the workflow file exists and read the relevant lines
fd -type f -name "semantic-release.yml"Repository: devsy-org/devsy
Length of output: 230
🏁 Script executed:
# Read the workflow file to see the actual content
cat -n .github/workflows/semantic-release.yml | head -50Repository: devsy-org/devsy
Length of output: 1636
🌐 Web query:
GitHub bot signature verification custom author committer metadata
💡 Result:
GitHub provides a mechanism for GitHub Apps and bots to have their commits automatically marked as "Verified" without requiring manual GPG or SSH key management [1][2]. However, this automatic verification is subject to strict constraints regarding commit metadata [1][2]. To receive a "Verified" status via a bot signature, the commit request must meet the following criteria: 1. The request must be authenticated as the GitHub App or bot [1][2]. 2. The commit must contain no custom author information [1][2]. 3. The commit must contain no custom committer information [1][2]. 4. The commit must contain no custom signature information (e.g., it cannot be manually signed via the Commits API) [1][2]. If you provide custom author or committer metadata, GitHub will not apply the automatic bot signature verification [1][2]. In such cases, the commit will remain unverified unless it is signed using a GPG, SSH, or S/MIME key associated with a user account or a configured bot identity [2][3]. For workflows that require both custom metadata (such as specific author/committer names and emails) and verified status, you must manually sign the commits [4][5]. This is typically achieved in GitHub Actions by: - Importing a GPG or SSH private key into the runner environment [4][5]. - Configuring the local Git environment (e.g., user.name, user.email, commit.gpgsign, and user.signingkey) to use that key [4][5]. - Performing the commit locally within the runner, which allows you to specify the desired author and committer metadata while still producing a cryptographically verifiable signature [4][5][6]. Note that the GitHub REST API for creating commits allows for custom author and committer fields, but using these fields will disqualify the commit from the automatic bot signature verification process [1][7][6].
Citations:
- 1: https://docs.github.com/en/authentication/managing-commit-signature-verification/about-commit-signature-verification
- 2: https://docs.github.com/en/github/authenticating-to-github/managing-commit-signature-verification/about-commit-signature-verification
- 3: https://docs.github.com/en/authentication/managing-commit-signature-verification
- 4: https://github.com/marketplace/actions/git-ssh-signing-action
- 5: For anyone looking to add commit signing (GPG) stefanzweifel/git-auto-commit-action#334
- 6: https://192dot.medium.com/sign-commit-using-github-actions-app-13488f6e76b7
- 7: https://docs.github.com/rest/git/commits
Custom git identity prevents bot signature verification on release commits.
Lines 35-38 set custom author/committer metadata (user.name and user.email). However, GitHub's bot signature verification explicitly requires that commits contain no custom author or committer information to be automatically marked verified. With this configuration, semantic-release will create commits that are not verified, even though authenticated as a bot via the GitHub App token.
Choose one path:
- Remove lines 35-38 to allow automatic bot signature verification (semantic-release will use the app identity), or
- Add manual GPG/SSH signing (import key, configure
commit.gpgsign,user.signingkey) to obtain verified commits with custom metadata.
Verify the approach meets your branch protection requirements for verified commits.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/semantic-release.yml around lines 35 - 38, The workflow
currently sets a custom Git identity via the git config commands that set
user.name and user.email, which prevents GitHub's bot signature verification;
either remove those git config lines so semantic-release uses the GitHub App
identity (allowing automatic verified commits), or keep them but implement
explicit commit signing by importing a GPG/SSH key and configuring
commit.gpgsign and user.signingkey in the workflow before committing so created
commits are verified; update the semantic-release job accordingly and ensure the
chosen approach satisfies branch protection rules for verified commits.
# [1.4.0-rc.1](v1.3.0...v1.4.0-rc.1) (2026-05-19) ### Bug Fixes * **ci:** add package-lock.json for semantic-release workflow ([bcd9208](bcd9208)) * **ci:** add signed commit config and create-release-pr workflow ([c89325a](c89325a)) * **ci:** advance prerelease manifest past stable release ([#372](#372)) ([33a9d44](33a9d44)) * **ci:** pass app token via token input for softprops/action-gh-release ([#361](#361)) ([77a9373](77a9373)), closes [softprops/action-#release](https://github.com/softprops/action-/issues/release) * **ci:** re-add changelog and git plugins with signed commit support ([#375](#375)) ([ad6e3f9](ad6e3f9)) * **ci:** remove @semantic-release/git plugin that can't push to protected branch ([c3bf35c](c3bf35c)) * **ci:** remove @semantic-release/git plugin that cannot push to signature-protected branch ([e971f37](e971f37)) * **ci:** resolve semantic-release tag conflict and add changelog+git plugins ([d80ae42](d80ae42)) * update workspace_result.json paths on workspace rename ([#369](#369)) ([f06f4ba](f06f4ba)) ### Features * auto-overwrite stale agent binary and workspace clean command ([#364](#364)) ([76841a4](76841a4)) * **ci:** enable autoMergeRequest in release-please action ([#363](#363)) ([2f889bb](2f889bb)) * **ci:** migrate from release-please to semantic-release ([#374](#374)) ([9fcceef](9fcceef)) * **ci:** replace single release-please config with dual prerelease/stable setup ([#368](#368)) ([d985356](d985356))
1 participant
Summary
Summary by CodeRabbit