Add gpg commit signature to the sync-manifests workflow

[averevki]

sync-manifests PRs can't be merged without the verified commit signature, e.g. #336

Summary by CodeRabbit

• Chores
  • Enabled commit signing for automatically created pull requests, improving trust and traceability of generated changes.

[coderabbitai]

📝 Walkthrough

Walkthrough

This change adds sign-commits: true to the peter-evans/create-pull-request@v7 step within the sync-authorino-manifests GitHub Actions workflow, enabling commit signing for pull requests generated by the workflow. No other logic changes.

Changes

Workflow Signing Update

Layer / File(s)	Summary
Enable sign-commits in create-pull-request step .github/workflows/sync-authorino-manifests.yaml	Adds sign-commits: true to the peter-evans/create-pull-request@v7 step to sign commits in generated pull requests.

Estimated code review effort: 1 (Trivial) | ~2 minutes

Possibly related PRs

• Kuadrant/authorino-operator#328: Both PRs modify the same peter-evans/create-pull-request@v7 step in .github/workflows/sync-authorino-manifests.yaml.

Suggested reviewers: guicassolato

Poem

A single line, signed and true,
Commits now wear a trusty hue,
Hop, hop, through the workflow's door,
One small tweak, and nothing more,
🐇✨ signed with care, forevermore!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the change: enabling commit signing in the sync-manifests workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch sync-manifests-gpg-sign

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/sync-authorino-manifests.yaml (1)

48-53: 🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

sign-commits: true needs a bot token here
peter-evans/create-pull-request only signs commits with GITHUB_TOKEN or a GitHub App token; with secrets.KUADRANT_DEV_PAT the PR is still created, but the commit remains unsigned. Switch this step to a bot-generated token, or drop sign-commits if signed commits are not required.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/sync-authorino-manifests.yaml around lines 48 - 53, The
create-pull-request step is configured to sign commits, but the current token is
a personal access token rather than a bot-generated token, so the commit will
not actually be signed. Update the token used by the
peter-evans/create-pull-request action to a bot-compatible token such as
GITHUB_TOKEN or a GitHub App token, or remove the sign-commits setting if signed
commits are not required. Use the existing create-pull-request step
configuration to locate and adjust the token/signing options together.

Source: MCP tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Outside diff comments:
In @.github/workflows/sync-authorino-manifests.yaml:
- Around line 48-53: The create-pull-request step is configured to sign commits,
but the current token is a personal access token rather than a bot-generated
token, so the commit will not actually be signed. Update the token used by the
peter-evans/create-pull-request action to a bot-compatible token such as
GITHUB_TOKEN or a GitHub App token, or remove the sign-commits setting if signed
commits are not required. Use the existing create-pull-request step
configuration to locate and adjust the token/signing options together.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 29c00790-132b-4def-9b0b-390200605aa1

📥 Commits

Reviewing files that changed from the base of the PR and between 00c056c and 625e570.

📒 Files selected for processing (1)

• .github/workflows/sync-authorino-manifests.yaml

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.20%. Comparing base (00c056c) to head (625e570).

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #337   +/-   ##
=======================================
  Coverage   57.20%   57.20%           
=======================================
  Files          13       13           
  Lines        1458     1458           
=======================================
  Hits          834      834           
  Misses        529      529           
  Partials       95       95           

Flag	Coverage Δ
unit	57.20% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.