feat: add collapsable list for skipped checks

Author: bordumb

.github/workflows/release.yml

@@ -1,5 +1,4 @@
 # Triggered by: python scripts/release.py --push
-# (tags vX.Y.Z and pushes, which triggers this workflow)
 
 name: Release
 
@@ -31,13 +30,11 @@ jobs:
       - name: Check dist is up to date
         run: git diff --exit-code -- dist/ ':!dist/**/*.d.ts.map'
 
-      # --- Artifact signing (dogfood: sign dist/index.js using auths-dev/sign@v1) ---
-      - name: Sign and verify dist/index.js
+      # Dogfood: sign dist/index.js using auths-dev/sign@v1 (ephemeral, no secrets)
+      - name: Sign dist/index.js
         uses: auths-dev/sign@v1
         with:
-          token: ${{ secrets.AUTHS_CI_TOKEN }}
           files: 'dist/index.js'
-          verify: true
           note: 'GitHub Actions release — ${{ github.ref_name }}'
 
       - name: Generate SHA256 checksums
@@ -60,22 +57,12 @@ jobs:
           body: |
             ## Auths Verify GitHub Action
 
-            Verify commit signatures and artifact attestations in your CI pipeline using [Auths](https://github.com/auths-dev/auths) identity keys.
+            Verify commit signatures and artifact attestations in CI.
 
             ### Usage
 
             ```yaml
             - uses: auths-dev/verify@v1
-              with:
-                token: '.auths/allowed_signers'
-            ```
-
-            **New: Artifact verification**
-            ```yaml
-            - uses: auths-dev/verify@v1
-              with:
-                token: $\{{ secrets.AUTHS_CI_TOKEN }}
-                files: 'dist/*.tar.gz'
             ```
 
             See the [README](https://github.com/auths-dev/verify#readme) for full configuration options.

.github/workflows/sign-commits.yml

@@ -21,5 +21,4 @@ jobs:
 
       - uses: auths-dev/sign@v1
         with:
-          token: ${{ secrets.AUTHS_CI_TOKEN }}
           commits: 'HEAD~1..HEAD'

action.yml

@@ -3,8 +3,8 @@ description: 'Verify cryptographic commit and artifact signatures on every PR us
 author: 'auths-dev'
 
 inputs:
-  token:
-    description: 'Identity for verification. Accepts: AUTHS_CI_TOKEN JSON, identity bundle JSON, file path to bundle, or path to allowed_signers file. Default: .auths/allowed_signers'
+  identity:
+    description: 'Identity for verification. Accepts: identity bundle JSON, file path to bundle, or path to allowed_signers file. Default: .auths/allowed_signers'
     required: false
     default: ''
   commits:

src/main.ts

@@ -356,11 +356,13 @@ export function buildSummaryMarkdown(
   lines.push('| Commit | Status | Details |');
   lines.push('|--------|--------|---------|');
 
+  const skippedRows: string[] = [];
+
   for (const result of results) {
     const shortSha = `\`${result.commit.substring(0, 8)}\``;
 
     if (result.skipped) {
-      lines.push(`| ${shortSha} | Skipped | ${result.skipReason || 'N/A'} |`);
+      skippedRows.push(`| ${shortSha} | Skipped | ${result.skipReason || 'N/A'} |`);
     } else if (result.valid) {
       const signer = result.signer || 'verified';
       lines.push(`| ${shortSha} | \u2705 Verified | Signed by ${signer} |`);
@@ -370,6 +372,20 @@ export function buildSummaryMarkdown(
     }
   }
 
+  // Collapse skipped commits if there are more than 3
+  if (skippedRows.length > 0 && skippedRows.length <= 3) {
+    lines.push(...skippedRows);
+  } else if (skippedRows.length > 3) {
+    lines.push('');
+    lines.push(`<details><summary>${skippedRows.length} skipped commits (merge commits)</summary>`);
+    lines.push('');
+    lines.push('| Commit | Status | Details |');
+    lines.push('|--------|--------|---------|');
+    lines.push(...skippedRows);
+    lines.push('');
+    lines.push('</details>');
+  }
+
   lines.push('');
   const resultEmoji = failed === 0 ? '\u2705' : '\u274c';
   let resultLine = `**Result:** ${resultEmoji} ${passed}/${total} commits verified`;