fix(ci): sign bot commits and auto-update specs on build failure

[marythought]

Summary

• Fix unsigned commits from github-actions[bot] by adding the numeric user ID prefix (41898282+) to the committer email — this enables GitHub to verify the signature, unblocking merge on repos with branch protection requiring verified commits
• Add workflow_run trigger so the vendored spec update runs automatically whenever a Test deployment workflow fails (e.g., due to stale specs)

Test plan

• Merge this PR, then re-run the "Update vendored OpenAPI specs" workflow — verify the resulting commit on PR chore(deps): update vendored OpenAPI specs #289 shows as "Verified"
• Trigger a test-deploy failure to confirm the update-vendored-specs workflow fires automatically

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Added an upstream workflow trigger so the update workflow can run after a related workflow completes.
  • Restricted the update job to run only on manual invocation or when the upstream workflow finishes with failure.
  • Updated the automated commit identity used by the workflow for generated commits.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[coderabbitai]

Warning

Rate limit exceeded

@marythought has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 18 minutes and 34 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 18 minutes and 34 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: ea9d958a-c7cc-4f95-9c05-b0067071fc93

📥 Commits

Reviewing files that changed from the base of the PR and between 73ad378 and 3c2490a.

📒 Files selected for processing (2)

• .github/workflows/test-deploy.yaml
• .github/workflows/update-vendored-specs.yaml

📝 Walkthrough

Walkthrough

This change updates the spec update GitHub Actions workflow: adds a workflow_run trigger for the "Test deployment" workflow completion, restricts the update-specs job to run only on manual dispatch or when the upstream workflow failed, and updates the git commit email to the numeric bot ID.

Changes

Cohort / File(s)	Summary
GitHub Actions workflow ​.github/workflows/update-vendored-specs.yaml	Added on.workflow_run (workflows: ["Test deployment"], types: [completed]); added job-level `if: github.event_name == 'workflow_dispatch'

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~8 minutes

Possibly related PRs

• chore(ci): add manual workflow to update vendored OpenAPI specs #248: Previously added/modified the same workflow file; directly related changes to triggers, job conditions, and commit email.

Suggested reviewers

• dmihalcik-virtru
• pflynn-virtru

Poem

🐰 I hopped through YAML lines with glee,
When tests complete, they call to me,
I only act when someone’s sent,
Or when an upstream job lamented,
My little bot-mail signs the tree. 🥕

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The pull request title directly addresses both main changes: signing bot commits (via email update) and auto-updating specs on build failure (via workflow_run trigger), matching the changeset perfectly.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/ci-signed-commits

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}