sign-artifacts can't auto-commit new signatures to main (needs bot push access or a PAT)

[enricopiovesan]

Context

registry#334 built the Ed25519 sign-artifacts CI job and registry#335 backfilled all 83 published capabilities. Signing itself works end to end (verified: docs/decision-log.md entry 77).

The one remaining gap: on a future merge to main that publishes a new capability, the sign-artifacts job signs the artifact but cannot commit the signature.json back to main on its own. traverse-framework/registry's main is protected by the org traverse-governance-* rulesets, and github-actions[bot] is not on their bypass list. The GITHUB_TOKEN also can't open a PR that runs CI (GitHub blocks GITHUB_TOKEN-triggered workflow runs), so an auto-opened PR can't satisfy required checks either.

Current behaviour (registry#339)

The job always uploads capabilities/**/signature.json + catalog/signing-key.pub as the artifact-signatures workflow artifact, and on push events attempts the direct commit, degrading to a ::warning:: (run still succeeds) when the push is refused. So new publishes are recoverable — a maintainer downloads the artifact and opens a normal PR — but not automatic. Runbook: docs/artifact-signing.md step 3.

Options

1. Dedicated bot PAT / GitHub App token as a repo secret, used by the job to push directly (or to open a PR that does trigger CI). Keeps main protection intact; adds one secret to rotate.
2. Add github-actions[bot] to the traverse-governance-* ruleset bypass list for main. Simplest mechanically, but weakens a governance ruleset — a deliberate governance decision, not a routine toggle.
3. Leave as-is — maintainer PRs the signature after each new-capability publish using the uploaded artifact. Fine while publish volume is low.

Recommendation

Option 1 if/when publish cadence makes the manual step annoying; Option 3 until then. Needs an owner decision — not something to pick unilaterally.

DoD

• Decision recorded (here or docs/decision-log.md).
• If option 1: PAT/App token provisioned, sign-artifacts job updated to use it, verified on a real new-capability publish.
• docs/artifact-signing.md step 3 updated to match the decision.

[enricopiovesan]

Decision (/brainstorm 341 355 365, 2026-09-06 — decision-log entry 85): stay manual for now (option 3).

Publish cadence is low, the recoverable path already exists and is documented (docs/artifact-signing.md step 3), and neither a new secret to rotate (option 1) nor a deliberately weakened traverse-governance-* ruleset (option 2) is justified by the current pain. Option 1 remains the right eventual answer; option 2 is rejected at any stage.

Revisit trigger: reconsider option 1 once new-capability publishes sustain more than ~1 per week (starting guide, tunable).

Status: kept open as the tracking vehicle. It stays in the board's Blocked column only because Project 3's Status field has no Deferred option — this is decision-deferred, not blocked on work.

Follow-up (not yet done): reword docs/artifact-signing.md step 3 so it presents the manual path as the chosen approach, not merely a fallback.

[enricopiovesan]

Revisit (2026-09-14 first-contributor-publish brainstorm, decision-log entry 113).

Entry 85 parked this as option 3 (manual maintainer PR) until cadence exceeded ~1 publish/week, and rejected option 2 (ruleset bypass) at any stage.

Outside contributors are now on the one-PR publish path (#487, #485, #488, #489). The #487 merge reproduced the exact hole: sign-artifacts created text.truncate@1.0.0/signature.json and git push origin HEAD:main was rejected (Changes must be made through a pull request + required checks). Push capability-validation then hard-failed signature.missing because the PR exemption does not apply on push.

New decision: option 1 — automatic follow-up PR, not a main bypass.

• Keep post-merge signing (fork PRs cannot see ARTIFACT_SIGNING_ED25519_SECRET_KEY).
• Do not add github-actions[bot] to the traverse-governance-* bypass list (option 2 stays rejected).
• Change the job to open a signature-sibling PR with a token that does trigger CI (dedicated PAT / GitHub App), same shape as chore(signing): land audio.detect-speech-segments@1.0.0 signature sibling (#460) #462 / chore(signing): land audio.transcribe-speech@1.0.0 signature sibling #475 / chore(signing): land audio.transcribe-speech@1.1.0 signature sibling #479 / chore(signing): land text.redact-entities@1.0.0 signature sibling #483 / chore(signing): land text.truncate@1.0.0 signature sibling #508.
• Manual download of artifact-signatures remains the fallback if the auto-PR fails.

Firefight for #487: #508.

This ticket stays the implementation vehicle for the auto-PR. DoD from the original body still applies, with option 1 now chosen rather than deferred.