Loosen GitHub verified-signatures branch rule to unblock the mirror #114

New issue

Open

opened 2026-05-27 03:35:44 +00:00 by coilysiren · 0 comments

coilysiren commented

2026-05-27 03:35:44 +00:00

Owner

Problem

GitHub branch protection on coilysiren/coily refs/heads/main requires verified signatures on every commit. With the migration to Forgejo-canonical + Forgejo->GitHub mirror (coily#113), the GitHub side becomes a read-only mirror. Forgejo accepts unsigned commits (e.g. those generated by the in-pod release workflow), and those unsigned commits then block the mirror push to GitHub.

Concrete blocker: commit 6d7fecab1524a1a723bb5154dd9e3a7d17ed1908 on Forgejo main is unsigned. Local git push origin main to GitHub is rejected:

remote: error: GH013: Repository rule violations found for refs/heads/main.
remote: - Commits must have verified signatures.
remote:   Found 1 violation:
remote:   6d7fecab1524a1a723bb5154dd9e3a7d17ed1908

Fix shape

Loosen or remove the verified-signatures branch rule at https://github.com/coilysiren/coily/rules?ref=refs%2Fheads%2Fmain. Since GitHub is now a read-only mirror of Forgejo, the signing requirement is vestigial - it was protecting a write surface that no longer exists. Forgejo enforces its own write-side discipline.

Two options:

Remove the verified-signatures rule entirely. Cleanest, matches the read-only-mirror posture.
Add an exemption for the bypass actor of the mirror PAT (the user/bot whose token pushes from Forgejo Actions).

Out of scope

Whether to keep any other GitHub branch protections. Most are vestigial now but a few might still serve as belt-and-suspenders (force-push prevention against a compromised mirror PAT, for example).

Related

coily#113 (release pipeline to Forgejo Actions)
Encountered during the 2026-05-26 security-review fix chain.

Note

Kai is working this in a separate session.

**Problem** GitHub branch protection on `coilysiren/coily` `refs/heads/main` requires verified signatures on every commit. With the migration to Forgejo-canonical + Forgejo->GitHub mirror (coily#113), the GitHub side becomes a read-only mirror. Forgejo accepts unsigned commits (e.g. those generated by the in-pod release workflow), and those unsigned commits then block the mirror push to GitHub. Concrete blocker: commit `6d7fecab1524a1a723bb5154dd9e3a7d17ed1908` on Forgejo main is unsigned. Local `git push origin main` to GitHub is rejected: ``` remote: error: GH013: Repository rule violations found for refs/heads/main. remote: - Commits must have verified signatures. remote: Found 1 violation: remote: 6d7fecab1524a1a723bb5154dd9e3a7d17ed1908 ``` **Fix shape** Loosen or remove the verified-signatures branch rule at https://github.com/coilysiren/coily/rules?ref=refs%2Fheads%2Fmain. Since GitHub is now a read-only mirror of Forgejo, the signing requirement is vestigial - it was protecting a write surface that no longer exists. Forgejo enforces its own write-side discipline. Two options: 1. Remove the verified-signatures rule entirely. Cleanest, matches the read-only-mirror posture. 2. Add an exemption for the bypass actor of the mirror PAT (the user/bot whose token pushes from Forgejo Actions). **Out of scope** Whether to keep any other GitHub branch protections. Most are vestigial now but a few might still serve as belt-and-suspenders (force-push prevention against a compromised mirror PAT, for example). **Related** - coily#113 (release pipeline to Forgejo Actions) - Encountered during the 2026-05-26 security-review fix chain. **Note** Kai is working this in a separate session.

coilysiren added the

label

2026-05-31 01:52:38 +00:00

coilysiren added

and removed

labels

2026-05-31 06:59:43 +00:00

No labels

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

coilyco-bridge/coily#114

No description provided.

Rows
Columns