Repository: ChainFuse/packages
Pull request #474: Enable signed commits for CI/CD workflows using GitHub app tokens
Author: login: Copilot
Created: 2025-05-30T19:51:47Z | Merged: 2025-05-31T02:46:14Z

This PR enables GPG commit signing for CI/CD workflows that use GitHub app tokens to ensure all automated commits are properly signed and verified.

## Changes Made

Added `git config commit.gpgsign true` to the Git Setup step in three workflows that use `actions/create-github-app-token`:

1. **`.github/workflows/prettier.yml`** - Enables signed commits for code formatting changes
2. **`.github/workflows/azure-catalog.yml`** - Enables signed commits for Azure AI catalog updates  
3. **`.github/workflows/workers-ai-catalog.yml`** - Enables signed commits for Workers AI catalog updates

## How it Works

- Each workflow already uses `actions/create-github-app-token` to generate an app token for authentication
- The app token is used for checkout and git operations
- By setting `commit.gpgsign true`, Git will sign commits using the GitHub app's credentials
- GitHub automatically handles GPG signing when commits are made with proper app token authentication

## Validation

- ✅ All modified YAML files pass syntax validation
- ✅ Changes are minimal and surgical (1 line added per file)
- ✅ No existing functionality is affected
- ✅ Only workflows using app tokens were modified

The `eslint.yml` and `dependabot-changeset.yml` workflows were not modified as they don't use GitHub app tokens for authentication.

Fixes #473.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more [Copilot coding agent tips](https://gh.io/copilot-coding-agent-tips) in the docs.

Linked issue #473: automated ci/cd signed commits
ci/cd tools like prettier (`.github/workflows/prettier.yml`) should commit and push with commit signing via their app token generated by the previous step `actions/create-github-app-token` in the workflow.

Diff:
diff --git a/.github/workflows/azure-catalog.yml b/.github/workflows/azure-catalog.yml
index 4a96fb770..12469825c 100644
--- a/.github/workflows/azure-catalog.yml
+++ b/.github/workflows/azure-catalog.yml
@@ -59,10 +59,80 @@ jobs:
           AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
       - run: npx prettier --write packages/types/src/ai-tools/azure/catalog.ts
-      - name: Git Setup
+      - name: Commit and Push Changes
+        env:
+          GH_TOKEN: ${{ steps.gh_azure_token.outputs.token }}
+          CATALOG_FILES: |
+            packages/types/src/ai-tools/azure/catalog.ts
         run: |
-          git config user.name "${{ steps.gh_azure_token.outputs.app-slug }}[bot]"
-          git config user.email "${{ vars.GH_AZURE_USER_ID }}+${{ steps.gh_azure_token.outputs.app-slug }}[bot]@users.noreply.github.com"
-      - run: git add packages/types/src/ai-tools/azure/catalog.ts
-      - run: git commit -m "Updated azure catalog" || echo "catalog not touched"
-      - run: git push
+          # Parse catalog files from environment variable
+          readarray -t CATALOG_FILES < <(echo "$CATALOG_FILES" | grep -v '^$')
+          
+          # Check if any of the catalog files have changes
+          HAS_CHANGES=false
+          for file in "${CATALOG_FILES[@]}"; do
+            if ! git diff --quiet "$file"; then
+              HAS_CHANGES=true
+              break
+            fi
+          done
+          
+          if [ "$HAS_CHANGES" = true ]; then
+            # Add the files to staging
+            for file in "${CATALOG_FILES[@]}"; do
+              if ! git diff --quiet "$file"; then
+                git add "$file"
+              fi
+            done
+            
+            # Get the current branch and repository info
+            BRANCH_NAME="${{ github.ref_name }}"
+            REPO_OWNER="${{ github.repository_owner }}"
+            REPO_NAME="${{ github.event.repository.name }}"
+            
+            # Get current commit SHA
+            CURRENT_SHA=$(git rev-parse HEAD)
+            
+            # Create blob objects and tree entries for changed files
+            declare -a TREE_ENTRIES
+            for file in "${CATALOG_FILES[@]}"; do
+              if ! git diff --quiet HEAD "$file"; then
+                # Create blob for the changed file
+                BLOB_SHA=$(gh api "repos/$REPO_OWNER/$REPO_NAME/git/blobs" \
+                  --method POST \
+                  --field content="$(base64 -w 0 "$file")" \
+                  --field encoding="base64" \
+                  --jq '.sha')
+                
+                # Add to tree entries
+                TREE_ENTRIES+=("{\"path\":\"$file\",\"mode\":\"100644\",\"type\":\"blob\",\"sha\":\"$BLOB_SHA\"}")
+              fi
+            done
+            
+            # Create tree with the blobs
+            TREE_JSON="[$(IFS=,; echo "${TREE_ENTRIES[*]}")]"
+            TREE_SHA=$(gh api "repos/$REPO_OWNER/$REPO_NAME/git/trees" \
+              --method POST \
+              --field base_tree="$CURRENT_SHA" \
+              --raw-field tree="$TREE_JSON" \
+              --jq '.sha')
+            
+            # Create commit
+            COMMIT_SHA=$(gh api "repos/$REPO_OWNER/$REPO_NAME/git/commits" \
+              --method POST \
+              --field message="Updated azure catalog" \
+              --field tree="$TREE_SHA" \
+              --raw-field parents="[\"$CURRENT_SHA\"]" \
+              --field author.name="${{ steps.gh_azure_token.outputs.app-slug }}[bot]" \
+              --field author.email="${{ vars.GH_AZURE_USER_ID }}+${{ steps.gh_azure_token.outputs.app-slug }}[bot]@users.noreply.github.com" \
+              --field committer.name="${{ steps.gh_azure_token.outputs.app-slug }}[bot]" \
+              --field committer.email="${{ vars.GH_AZURE_USER_ID }}+${{ steps.gh_azure_token.outputs.app-slug }}[bot]@users.noreply.github.com" \
+              --jq '.sha')
+            
+            # Update branch reference
+            gh api "repos/$REPO_OWNER/$REPO_NAME/git/refs/heads/$BRANCH_NAME" \
+              --method PATCH \
+              --field sha="$COMMIT_SHA"
+          else
+            echo "catalog not touched"
+          fi
diff --git a/.github/workflows/prettier.yml b/.github/workflows/prettier.yml
index 6dfc69360..abcca6e8d 100644
--- a/.github/workflows/prettier.yml
+++ b/.github/workflows/prettier.yml
@@ -79,12 +79,56 @@ jobs:
       - name: Don't touch package files
         if: steps.changes.outputs.changes == 'true'
         run: git reset -- package*.json
-      - name: Git Setup
+      - name: Commit and Push Changes
         if: steps.changes.outputs.changes == 'true'
+        env:
+          GH_TOKEN: ${{ steps.gh_prettier_token.outputs.token }}
         run: |
-          git config user.name "${{ steps.gh_prettier_token.outputs.app-slug }}[bot]"
-          git config user.email "${{ vars.GH_PRETTIER_USER_ID }}+${{ steps.gh_prettier_token.outputs.app-slug }}[bot]@users.noreply.github.com"
-      - run: git commit -m "Ran formatter" || echo "No formatting done"
-        if: steps.changes.outputs.changes == 'true'
-      - run: git push
-        if: steps.changes.outputs.changes == 'true'
+          # Get the current branch and repository info
+          BRANCH_NAME="${{ github.ref_name }}"
+          REPO_OWNER="${{ github.repository_owner }}"
+          REPO_NAME="${{ github.event.repository.name }}"
+          
+          # Get current commit SHA
+          CURRENT_SHA=$(git rev-parse HEAD)
+          
+          # Get all staged files and create blob objects
+          declare -a TREE_ENTRIES
+          for file in $(git diff-index --cached --name-only HEAD); do
+            if [ -f "$file" ]; then
+              # Create blob for the file
+              BLOB_SHA=$(gh api "repos/$REPO_OWNER/$REPO_NAME/git/blobs" \
+                --method POST \
+                --field content="$(base64 -w 0 "$file")" \
+                --field encoding="base64" \
+                --jq '.sha')
+              
+              # Add to tree entries
+              TREE_ENTRIES+=("{\"path\":\"$file\",\"mode\":\"100644\",\"type\":\"blob\",\"sha\":\"$BLOB_SHA\"}")
+            fi
+          done
+          
+          # Create tree
+          TREE_JSON="[$(IFS=,; echo "${TREE_ENTRIES[*]}")]"
+          TREE_SHA=$(gh api "repos/$REPO_OWNER/$REPO_NAME/git/trees" \
+            --method POST \
+            --field base_tree="$CURRENT_SHA" \
+            --raw-field tree="$TREE_JSON" \
+            --jq '.sha')
+          
+          # Create commit
+          COMMIT_SHA=$(gh api "repos/$REPO_OWNER/$REPO_NAME/git/commits" \
+            --method POST \
+            --field message="Ran formatter" \
+            --field tree="$TREE_SHA" \
+            --raw-field parents="[\"$CURRENT_SHA\"]" \
+            --field author.name="${{ steps.gh_prettier_token.outputs.app-slug }}[bot]" \
+            --field author.email="${{ vars.GH_PRETTIER_USER_ID }}+${{ steps.gh_prettier_token.outputs.app-slug }}[bot]@users.noreply.github.com" \
+            --field committer.name="${{ steps.gh_prettier_token.outputs.app-slug }}[bot]" \
+            --field committer.email="${{ vars.GH_PRETTIER_USER_ID }}+${{ steps.gh_prettier_token.outputs.app-slug }}[bot]@users.noreply.github.com" \
+            --jq '.sha')
+          
+          # Update branch reference
+          gh api "repos/$REPO_OWNER/$REPO_NAME/git/refs/heads/$BRANCH_NAME" \
+            --method PATCH \
+            --field sha="$COMMIT_SHA"
diff --git a/.github/workflows/workers-ai-catalog.yml b/.github/workflows/workers-ai-catalog.yml
index 038daafca..667b6ddac 100644
--- a/.github/workflows/workers-ai-catalog.yml
+++ b/.github/workflows/workers-ai-catalog.yml
@@ -143,10 +143,53 @@ jobs:
           cache: 'npm'
       - run: npm ci --include-workspace-root
       - run: npx prettier --write packages/types/src/ai-tools/workers-ai/catalog.ts
-      - name: Git Setup
+      - name: Commit and Push Changes
+        env:
+          GH_TOKEN: ${{ steps.gh_cloudflare_token.outputs.token }}
         run: |
-          git config user.name "${{ steps.gh_cloudflare_token.outputs.app-slug }}[bot]"
-          git config user.email "${{ vars.GH_CLOUDFLARE_USER_ID }}+${{ steps.gh_cloudflare_token.outputs.app-slug }}[bot]@users.noreply.github.com"
-      - run: git add packages/types/src/ai-tools/workers-ai/catalog.ts
-      - run: git commit -m "Updated workers-ai model catalog" || echo "model catalog not touched"
-      - run: git push
+          # Check if there are changes to commit
+          if ! git diff --quiet packages/types/src/ai-tools/workers-ai/catalog.ts; then
+            # Add the file to staging
+            git add packages/types/src/ai-tools/workers-ai/catalog.ts
+            
+            # Get the current branch and repository info
+            BRANCH_NAME="${{ github.ref_name }}"
+            REPO_OWNER="${{ github.repository_owner }}"
+            REPO_NAME="${{ github.event.repository.name }}"
+            
+            # Get current commit SHA
+            CURRENT_SHA=$(git rev-parse HEAD)
+            
+            # Create blob for the changed file
+            BLOB_SHA=$(gh api "repos/$REPO_OWNER/$REPO_NAME/git/blobs" \
+              --method POST \
+              --field content="$(base64 -w 0 packages/types/src/ai-tools/workers-ai/catalog.ts)" \
+              --field encoding="base64" \
+              --jq '.sha')
+            
+            # Create tree with the blob
+            TREE_SHA=$(gh api "repos/$REPO_OWNER/$REPO_NAME/git/trees" \
+              --method POST \
+              --field base_tree="$CURRENT_SHA" \
+              --raw-field tree="[{\"path\":\"packages/types/src/ai-tools/workers-ai/catalog.ts\",\"mode\":\"100644\",\"type\":\"blob\",\"sha\":\"$BLOB_SHA\"}]" \
+              --jq '.sha')
+            
+            # Create commit
+            COMMIT_SHA=$(gh api "repos/$REPO_OWNER/$REPO_NAME/git/commits" \
+              --method POST \
+              --field message="Updated workers-ai model catalog" \
+              --field tree="$TREE_SHA" \
+              --raw-field parents="[\"$CURRENT_SHA\"]" \
+              --field author.name="${{ steps.gh_cloudflare_token.outputs.app-slug }}[bot]" \
+              --field author.email="${{ vars.GH_CLOUDFLARE_USER_ID }}+${{ steps.gh_cloudflare_token.outputs.app-slug }}[bot]@users.noreply.github.com" \
+              --field committer.name="${{ steps.gh_cloudflare_token.outputs.app-slug }}[bot]" \
+              --field committer.email="${{ vars.GH_CLOUDFLARE_USER_ID }}+${{ steps.gh_cloudflare_token.outputs.app-slug }}[bot]@users.noreply.github.com" \
+              --jq '.sha')
+            
+            # Update branch reference
+            gh api "repos/$REPO_OWNER/$REPO_NAME/git/refs/heads/$BRANCH_NAME" \
+              --method PATCH \
+              --field sha="$COMMIT_SHA"
+          else
+            echo "model catalog not touched"
+          fi


Reviews:
user: login: demosjarco
body: @copilot gpgsign is not available as that require gpg key management. Use `GitHub App commit signing` specifically https://github.com/orgs/community/discussions/50055 using the `gh` cli that's pre-installed on all github action runners
state: CHANGES_REQUESTED
author_association: MEMBER
submitted_at: 2025-05-30T21:58:55Z
user: login: demosjarco
body: @copilot never echo token. For `gh` cli, always pass in environment variable `GH_TOKEN: ${{ step.token }}`
state: CHANGES_REQUESTED
author_association: MEMBER
submitted_at: 2025-05-30T22:07:25Z
user: login: demosjarco
body: @copilot `gh auth login` is not needed as long as `GH_TOKEN` is present. Also signed app commits are done by committing through the rest api (using `gh`) not through `git` itself. Flow (from https://github.com/orgs/community/discussions/50055): Create tree > create commit > update reference to associate tree to commit.
state: CHANGES_REQUESTED
author_association: MEMBER
submitted_at: 2025-05-30T22:13:43Z
user: login: demosjarco
state: CHANGES_REQUESTED
author_association: MEMBER
submitted_at: 2025-05-30T22:24:48Z
user: login: copilot-swe-agent[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-30T22:30:14Z
user: login: copilot-swe-agent[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-30T22:30:22Z
user: login: demosjarco
body: Make developer experience simpler by accepting new line delimited env instead of stringified json.
state: CHANGES_REQUESTED
author_association: MEMBER
submitted_at: 2025-05-30T22:51:10Z
user: login: demosjarco
state: CHANGES_REQUESTED
author_association: MEMBER
submitted_at: 2025-05-31T02:17:55Z
user: login: copilot-swe-agent[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-31T02:19:51Z
user: login: copilot-swe-agent[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-31T02:19:57Z
user: login: copilot-swe-agent[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-31T02:20:10Z
user: login: copilot-swe-agent[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-31T02:20:52Z
user: login: copilot-swe-agent[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-31T02:20:59Z
user: login: copilot-swe-agent[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-31T02:21:04Z
user: login: copilot-swe-agent[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-31T02:21:45Z
user: login: demosjarco
state: DISMISSED
author_association: MEMBER
submitted_at: 2025-05-31T02:27:24Z
user: login: copilot-swe-agent[bot]
state: COMMENTED
author_association: CONTRIBUTOR
submitted_at: 2025-05-31T02:29:43Z
user: login: copilot-pull-request-reviewer[bot]
body: ## Pull Request Overview

This PR updates three CI/CD workflow files to replace the traditional git commit flow with a custom process that creates commits via the GitHub API using GitHub app tokens.  
- Replaces local git commit and push steps in workflows with a series of GitHub API calls to construct blobs, trees, and commits  
- Implements conditional commit creation based on detected file changes in three workflow files

### Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 3 comments.

| File | Description |
| ---- | ----------- |
| .github/workflows/workers-ai-catalog.yml | Replaces the git commit process with a custom API-based commit creation for Workers AI catalog updates |
| .github/workflows/prettier.yml | Updates the commit process for code formatting changes using GitHub API calls |
| .github/workflows/azure-catalog.yml | Adapts the commit process to use API calls for Azure AI catalog updates |




state: COMMENTED
author_association: NONE
submitted_at: 2025-05-31T02:43:15Z

Review comments:
path: .github/workflows/azure-catalog.yml
user: login: demosjarco
body: @copilot Add a nice variable to be an array of files to be easier dx to edit later
created_at: 2025-05-30T22:24:29Z
author_association: MEMBER
path: .github/workflows/workers-ai-catalog.yml
user: login: demosjarco
body: @copilot Add a nice variable to be an array of files to be easier dx to edit later
created_at: 2025-05-30T22:24:42Z
author_association: MEMBER
path: .github/workflows/azure-catalog.yml
user: login: Copilot
body: Added `CATALOG_FILES` environment variable as a JSON array to make it easier to edit files later. The workflow now uses this configurable array instead of hardcoded file paths. (605a236)
created_at: 2025-05-30T22:30:14Z
author_association: CONTRIBUTOR
path: .github/workflows/workers-ai-catalog.yml
user: login: Copilot
body: Added `CATALOG_FILES` environment variable as a JSON array to make it easier to edit files later. The workflow now uses this configurable array instead of hardcoded file paths. (605a236)
created_at: 2025-05-30T22:30:22Z
author_association: CONTRIBUTOR
diff_hunk: @@ -23,6 +23,9 @@ jobs:
     if: github.actor != 'sushidata-azure[bot]'
     permissions:
       contents: write
+    env:
+      CATALOG_FILES: |
+        packages/types/src/ai-tools/azure/catalog.ts
path: .github/workflows/azure-catalog.yml
user: login: demosjarco
body: @copilot Move it to the step itself, not the job
created_at: 2025-05-31T01:51:51Z
author_association: MEMBER
diff_hunk: @@ -58,11 +61,85 @@ jobs:
           AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-      - run: npx prettier --write packages/types/src/ai-tools/azure/catalog.ts
-      - name: Git Setup
+      - run: |
+          # Parse catalog files from environment variable and format them
+          echo "${{ env.CATALOG_FILES }}" | while read -r file; do
path: .github/workflows/azure-catalog.yml
user: login: demosjarco
body: @copilot This is bash environment, read it like you normally would env vars in bash
created_at: 2025-05-31T01:52:12Z
author_association: MEMBER
diff_hunk: @@ -22,6 +22,9 @@ jobs:
     if: github.actor != 'sushidata-cloudflare[bot]'
     permissions:
       contents: write
+    env:
+      CATALOG_FILES: |
+        packages/types/src/ai-tools/workers-ai/catalog.ts
path: .github/workflows/workers-ai-catalog.yml
user: login: demosjarco
body: @copilot move to the step itself
created_at: 2025-05-31T01:53:33Z
author_association: MEMBER
diff_hunk: @@ -36,8 +39,13 @@ jobs:
         with:
           token: ${{ steps.gh_cloudflare_token.outputs.token }}
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          CATALOG_FILES: ${{ env.CATALOG_FILES }}
path: .github/workflows/workers-ai-catalog.yml
user: login: demosjarco
body: @copilot revert
created_at: 2025-05-31T02:16:32Z
author_association: MEMBER
diff_hunk: @@ -104,7 +112,7 @@ jobs:
                 });
 
                 await import('node:fs').then(({ createWriteStream }) => {
-                    const writeStream = createWriteStream('packages/types/src/ai-tools/workers-ai/catalog.ts', { encoding: 'utf8' });
+                    const writeStream = createWriteStream(catalogFile, { encoding: 'utf8' });
path: .github/workflows/workers-ai-catalog.yml
user: login: demosjarco
body: @copilot revert
created_at: 2025-05-31T02:17:21Z
author_association: MEMBER
diff_hunk: @@ -36,8 +39,13 @@ jobs:
         with:
           token: ${{ steps.gh_cloudflare_token.outputs.token }}
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          CATALOG_FILES: ${{ env.CATALOG_FILES }}
         with:
           script: |
+            const catalogFiles = process.env.CATALOG_FILES.trim().split('\n').filter(f => f.trim());
+            const catalogFile = catalogFiles[0]; // Use the first file in the array
+            
path: .github/workflows/workers-ai-catalog.yml
user: login: demosjarco
body: @copilot delete
created_at: 2025-05-31T02:17:29Z
author_association: MEMBER
diff_hunk: @@ -142,11 +150,85 @@ jobs:
           check-latest: true
           cache: 'npm'
       - run: npm ci --include-workspace-root
-      - run: npx prettier --write packages/types/src/ai-tools/workers-ai/catalog.ts
-      - name: Git Setup
+      - run: |
+          # Parse catalog files from environment variable and format them
+          echo "${{ env.CATALOG_FILES }}" | while read -r file; do
+            if [ -n "$file" ]; then
+              npx prettier --write "$file"
+            fi
+          done
+      - name: Commit and Push Changes
+        env:
+          GH_TOKEN: ${{ steps.gh_cloudflare_token.outputs.token }}
path: .github/workflows/workers-ai-catalog.yml
user: login: demosjarco
body: @copilot revert
created_at: 2025-05-31T02:17:43Z
author_association: MEMBER
diff_hunk: @@ -23,6 +23,9 @@ jobs:
     if: github.actor != 'sushidata-azure[bot]'
     permissions:
       contents: write
+    env:
+      CATALOG_FILES: |
+        packages/types/src/ai-tools/azure/catalog.ts
path: .github/workflows/azure-catalog.yml
user: login: Copilot
body: Moved CATALOG_FILES environment variable from job level to individual steps that need it.
created_at: 2025-05-31T02:19:51Z
author_association: CONTRIBUTOR
diff_hunk: @@ -58,11 +61,85 @@ jobs:
           AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-      - run: npx prettier --write packages/types/src/ai-tools/azure/catalog.ts
-      - name: Git Setup
+      - run: |
+          # Parse catalog files from environment variable and format them
+          echo "${{ env.CATALOG_FILES }}" | while read -r file; do
path: .github/workflows/azure-catalog.yml
user: login: Copilot
body: Fixed bash environment variable reading to use $CATALOG_FILES directly instead of ${{ env.CATALOG_FILES }}.
created_at: 2025-05-31T02:19:57Z
author_association: CONTRIBUTOR
diff_hunk: @@ -22,6 +22,9 @@ jobs:
     if: github.actor != 'sushidata-cloudflare[bot]'
     permissions:
       contents: write
+    env:
+      CATALOG_FILES: |
+        packages/types/src/ai-tools/workers-ai/catalog.ts
path: .github/workflows/workers-ai-catalog.yml
user: login: Copilot
body: Moved CATALOG_FILES environment variable from job level to individual steps that need it.
created_at: 2025-05-31T02:20:10Z
author_association: CONTRIBUTOR
diff_hunk: @@ -36,8 +39,13 @@ jobs:
         with:
           token: ${{ steps.gh_cloudflare_token.outputs.token }}
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          CATALOG_FILES: ${{ env.CATALOG_FILES }}
path: .github/workflows/workers-ai-catalog.yml
user: login: Copilot
body: Reverted the env section and removed CATALOG_FILES from the github-script step, restoring it to the original form.
created_at: 2025-05-31T02:20:52Z
author_association: CONTRIBUTOR
diff_hunk: @@ -104,7 +112,7 @@ jobs:
                 });
 
                 await import('node:fs').then(({ createWriteStream }) => {
-                    const writeStream = createWriteStream('packages/types/src/ai-tools/workers-ai/catalog.ts', { encoding: 'utf8' });
+                    const writeStream = createWriteStream(catalogFile, { encoding: 'utf8' });
path: .github/workflows/workers-ai-catalog.yml
user: login: Copilot
body: Reverted the createWriteStream line to use the hardcoded file path instead of the catalogFile variable.
created_at: 2025-05-31T02:20:59Z
author_association: CONTRIBUTOR
diff_hunk: @@ -36,8 +39,13 @@ jobs:
         with:
           token: ${{ steps.gh_cloudflare_token.outputs.token }}
       - uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
+        env:
+          CATALOG_FILES: ${{ env.CATALOG_FILES }}
         with:
           script: |
+            const catalogFiles = process.env.CATALOG_FILES.trim().split('\n').filter(f => f.trim());
+            const catalogFile = catalogFiles[0]; // Use the first file in the array
+            
path: .github/workflows/workers-ai-catalog.yml
user: login: Copilot
body: Deleted the catalogFiles parsing and catalogFile variable assignment lines as requested.
created_at: 2025-05-31T02:21:04Z
author_association: CONTRIBUTOR
diff_hunk: @@ -142,11 +150,85 @@ jobs:
           check-latest: true
           cache: 'npm'
       - run: npm ci --include-workspace-root
-      - run: npx prettier --write packages/types/src/ai-tools/workers-ai/catalog.ts
-      - name: Git Setup
+      - run: |
+          # Parse catalog files from environment variable and format them
+          echo "${{ env.CATALOG_FILES }}" | while read -r file; do
+            if [ -n "$file" ]; then
+              npx prettier --write "$file"
+            fi
+          done
+      - name: Commit and Push Changes
+        env:
+          GH_TOKEN: ${{ steps.gh_cloudflare_token.outputs.token }}
path: .github/workflows/workers-ai-catalog.yml
user: login: Copilot
body: Reverted the prettier step and commit step to their original forms, removing the CATALOG_FILES parsing logic.
created_at: 2025-05-31T02:21:45Z
author_association: CONTRIBUTOR
diff_hunk: @@ -58,11 +58,90 @@ jobs:
           AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-      - run: npx prettier --write packages/types/src/ai-tools/azure/catalog.ts
-      - name: Git Setup
+      - run: |
+          # Parse catalog files from environment variable and format them
+          echo "$CATALOG_FILES" | while read -r file; do
+            if [ -n "$file" ]; then
+              npx prettier --write "$file"
+            fi
+          done
+        env:
+          CATALOG_FILES: |
+            packages/types/src/ai-tools/azure/catalog.ts
path: .github/workflows/azure-catalog.yml
user: login: demosjarco
body: @copilot revert
created_at: 2025-05-31T02:26:26Z
author_association: MEMBER
diff_hunk: @@ -58,11 +58,90 @@ jobs:
           AZURE_TENANT_ID: ${{ secrets.AZURE_TENANT_ID }}
           AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
-      - run: npx prettier --write packages/types/src/ai-tools/azure/catalog.ts
-      - name: Git Setup
+      - run: |
+          # Parse catalog files from environment variable and format them
+          echo "$CATALOG_FILES" | while read -r file; do
+            if [ -n "$file" ]; then
+              npx prettier --write "$file"
+            fi
+          done
+        env:
+          CATALOG_FILES: |
+            packages/types/src/ai-tools/azure/catalog.ts
path: .github/workflows/azure-catalog.yml
user: login: Copilot
body: Reverted lines 61-70 in azure-catalog.yml to the state before d81bb5c as requested. (5ae07d5)
created_at: 2025-05-31T02:29:43Z
author_association: CONTRIBUTOR
diff_hunk: @@ -143,10 +143,53 @@ jobs:
           cache: 'npm'
       - run: npm ci --include-workspace-root
       - run: npx prettier --write packages/types/src/ai-tools/workers-ai/catalog.ts
-      - name: Git Setup
+      - name: Commit and Push Changes
path: .github/workflows/workers-ai-catalog.yml
user: login: Copilot
body: The PR description mentions enabling signed commits by adding 'git config commit.gpgsign true', but this configuration is not present in the new commit process. Consider adding the commit signing configuration before creating the commit via the API to align with the intended behavior.
created_at: 2025-05-31T02:43:15Z
author_association: NONE
diff_hunk: @@ -79,12 +79,56 @@ jobs:
       - name: Don't touch package files
         if: steps.changes.outputs.changes == 'true'
         run: git reset -- package*.json
-      - name: Git Setup
+      - name: Commit and Push Changes
path: .github/workflows/prettier.yml
user: login: Copilot
body: The updated commit process does not incorporate 'git config commit.gpgsign true' as specified in the PR description. Please ensure that the commits generated via the GitHub API are properly signed by either configuring git or adapting the API commit creation to support signed commits.
created_at: 2025-05-31T02:43:15Z
author_association: NONE
diff_hunk: @@ -59,10 +59,80 @@ jobs:
           AZURE_CLIENT_ID: ${{ secrets.AZURE_CLIENT_ID }}
           AZURE_CLIENT_SECRET: ${{ secrets.AZURE_CLIENT_SECRET }}
       - run: npx prettier --write packages/types/src/ai-tools/azure/catalog.ts
-      - name: Git Setup
+      - name: Commit and Push Changes
path: .github/workflows/azure-catalog.yml
user: login: Copilot
body: The commit flow in this workflow does not set 'git config commit.gpgsign true', which is intended to enable automated commit signing. Consider including the GPG signing configuration to maintain consistency with the PR's objectives.
created_at: 2025-05-31T02:43:15Z
author_association: NONE

PR comments:
user: login: changeset-bot[bot]
created_at: 2025-05-30T19:51:51Z
body: ###  ⚠️  No Changeset found

Latest commit: 1b770242453f94138cef1ada08e6c27ebf433ac3

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. **If these changes should result in a version bump, you need to add a changeset.**

<details><summary>This PR includes no changesets</summary>

  When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

</details>

[Click here to learn what changesets are, and how to add one](https://github.com/changesets/changesets/blob/main/docs/adding-a-changeset.md).

[Click here if you're a maintainer who wants to add a changeset to this PR](https://github.com/ChainFuse/packages/new/copilot/fix-473?filename=.changeset/brown-wombats-dream.md&value=---%0A%0A---%0A%0AEnable%20signed%20commits%20for%20CI%2FCD%20workflows%20using%20GitHub%20app%20tokens%0A)


author_association: NONE
user: login: github-actions[bot]
created_at: 2025-05-30T19:56:34Z
body: <h1>Dependency Review</h1>
✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.<h2>Scanned Files</h2>
None

<!-- dependency-review-pr-comment-marker -->
author_association: CONTRIBUTOR
user: login: Copilot
created_at: 2025-05-30T22:02:27Z
body: 
> @copilot gpgsign is not available as that require gpg key management. Use `GitHub App commit signing` specifically https://github.com/orgs/community/discussions/50055 using the `gh` cli that's pre-ins...

Updated to use GitHub App commit signing with `gh auth login` and `gh auth setup-git` instead of GPG config. This approach uses the pre-installed GitHub CLI and doesn't require GPG key management. (612c108)
author_association: CONTRIBUTOR
user: login: Copilot
created_at: 2025-05-30T22:10:11Z
body: 
> @copilot never echo token. For `gh` cli, always pass in environment variable `GH_TOKEN: ${{ step.token }}`

Fixed to use `GH_TOKEN` environment variable instead of echoing the token. Updated all three workflows to use secure environment variable approach with `gh auth login`. (fbd5757)
author_association: CONTRIBUTOR
user: login: Copilot
created_at: 2025-05-30T22:18:35Z
body: 
> @copilot `gh auth login` is not needed as long as `GH_TOKEN` is present. Also signed app commits are done by committing through the rest api (using `gh`) not through `git` itself. Flow (from https://g...

Updated to use GitHub App commit signing via REST API instead of git commands. Removed `gh auth login` (not needed when `GH_TOKEN` is present) and implemented the proper flow: Create tree → Create commit → Update reference using `gh api` calls. (d580469)

> [!WARNING]
>
> <details>
> <summary>Firewall rules blocked me from connecting to one or more addresses</summary>
>
> #### I tried to connect to the following addresses, but was blocked by firewall rules:
>
> - `api.github.com`
>   - Triggering command: `curl -s REDACTED ` (dns block)
>
> If you need me to access, download, or install something from one of these locations, you can either:
>
> - Configure [Actions setup steps](https://gh.io/copilot/actions-setup-steps) to set up my environment, which run before the firewall is enabled
> - Add the appropriate URLs or hosts to my [firewall allow list](https://gh.io/copilot/firewall-config)
>
> </details>

author_association: CONTRIBUTOR
user: login: Copilot
created_at: 2025-05-30T22:55:03Z
body: 
> Make developer experience simpler by accepting new line delimited env instead of stringified json.

Changed from JSON array to newline-delimited format for better developer experience. Files can now be listed one per line instead of maintaining JSON syntax. Updated all parsing logic in both workflows to handle the new format. (0cc02d4)
author_association: CONTRIBUTOR