fix(ci): skip cosign signing on Dependabot PRs (#44)

* fix(ci): skip cosign signing on Dependabot PRs

Dependabot-triggered pull_request runs get no access to Actions secrets,
so secrets.SIGNING_SECRET is empty and the blue-build cosign signing step
fails the whole build_push job (~10s, before any real build). Merging then
runs the same workflow on push to main, where the secret is available, so
it succeeds -- which is why these PRs fail on cosign yet pass after merge.

Only pass the cosign key on non-PR events. PR builds still validate that
the image builds; the real sign+push happens on push to main. Also document
the behavior in the README maintainer notes.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(ci): build-only on PRs instead of trying to sign

The previous commit was the wrong fix. Emptying the cosign key on PRs did
not help: the BlueBuild action defaults to push=true and always signs what
it pushes, so on a pull_request it still attempts to push a pr-<n> image and
cosign-sign it, failing early (~10s) when SIGNING_SECRET is unavailable.
This is why *every* PR (not just Dependabot) failed on cosign while the same
commit succeeded on push to main.

Set push=false on pull_request so PRs are build-only -- the image is still
built and validated, just not published or signed. Restore the plain
SIGNING_SECRET key (used only on push/schedule now) and update the README
maintainer note to match.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: alfredgamulo

.github/workflows/build.yml

@@ -43,6 +43,17 @@ jobs:
         uses: blue-build/github-action@836161eb076426a451e6a0054f722b1153b8b3ad  # v1.12.0
         with:
           recipe: recipe.yml
+          # Only push+sign on non-PR events. The action defaults to push=true
+          # and always cosign-signs what it pushes, so on a `pull_request` it
+          # tries to push a `pr-<n>`-tagged image AND sign it. Signing needs
+          # SIGNING_SECRET, which is empty on PRs (Dependabot PRs get no Actions
+          # secrets at all; regular PRs would sign but we don't want unreviewed
+          # code pushed under our key), so the job fails early at the cosign
+          # step (~10s). Setting push=false on PRs makes them build-only: the
+          # image is still fully built and validated, just not published or
+          # signed. The real sign+push happens on the push to main after merge
+          # (see the build_iso note below, which relies on the same condition).
+          push: ${{ github.event_name != 'pull_request' }}
           cosign_private_key: ${{ secrets.SIGNING_SECRET }}
           registry_token: ${{ github.token }}
           pr_event_number: ${{ github.event.number }}

README.md

@@ -102,6 +102,7 @@ Things that aren't obvious from reading the recipe, for whoever returns to this
 - **Keep signing with the same key.** The image must keep being signed by the cosign key whose public half is [`cosign.pub`](cosign.pub) (private half = the `SIGNING_SECRET` secret). Rotating it breaks signed updates for existing installs.
 - **Winboat is pinned and checksum-verified.** [`files/scripts/20-install-winboat.sh`](files/scripts/20-install-winboat.sh) installs an exact version and checks a vetted SHA-256 (the upstream RPM is unsigned, and no upstream checksum is published). To update it, bump `WINBOAT_VERSION` **and** `WINBOAT_SHA256` together — a mismatch fails the build by design. It does not auto-update; check the [Winboat releases](https://github.com/TibixDev/winboat/releases) periodically.
 - **GitHub Actions are pinned to commit SHAs** with a `# vX` comment; Dependabot ([`.github/dependabot.yml`](.github/dependabot.yml)) opens PRs to bump them. Review those PRs rather than blindly merging.
+- **CI does not push or sign on pull requests — only on merge.** The BlueBuild action defaults to `push: true` and always cosign-signs what it pushes. Left unchecked, a `pull_request` run tries to push a `pr-<n>`-tagged image and sign it, which needs `SIGNING_SECRET` — and that secret is empty on PRs (GitHub withholds Actions secrets from Dependabot PRs entirely, so a malicious bump can't exfiltrate them). The signing step then fails the whole `build_push` job early (~10s). [`build.yml`](.github/workflows/build.yml) sets `push: ${{ github.event_name != 'pull_request' }}`, so PRs are **build-only**: the image is still built and validated, just not published or signed. The real sign + push happens on the `push` to `main` after merge. This is why a PR could fail on cosign yet the same commit succeed once merged.
 - **Pinned third-party versions are watched by [`release-watch`](.github/workflows/release-watch.yml).** Dependabot can't track a version pinned in a shell script, so a weekly job compares each package listed in [`.github/release-watch.json`](.github/release-watch.json) against its upstream's latest release and opens an issue when a newer one exists. To watch another package whose version is pinned shell-style as `pin_key="<version>"`, add one entry (`name`, `repo`, `pin_file`, `pin_key`) — no workflow change needed. The job only fires an issue when upstream is strictly newer (version-ordered), and a package pinned in some other format fails the job loudly so you know the extraction step needs extending.
 
 # Verifying signatures