Skip to content

docs(release): document signing release tags with gitsign #250

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
gtauzin merged 1 commit into from
Jul 26, 2026
+13 −3
Merged

docs(release): document signing release tags with gitsign #250

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/pages/explanation/release-process.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@ The version is determined by the Git tag - there is no version file to manually

## The Complete Flow in Practice

1. Developer pushes a version tag: `git tag v0.2.0 -m "Release v0.2.0" && git push origin v0.2.0`
1. Developer pushes a **signed** version tag: `git tag -s v0.2.0 -m "Release v0.2.0" && git push origin v0.2.0` (tags are signed with [gitsign](https://github.com/sigstore/gitsign) keyless Sigstore signing, so the tag is verifiable with no long-lived GPG key; this complements the artifact-level PEP 740 attestations)
2. `changelog.yml` generates the changelog, builds the package, creates a PR
3. Maintainer reviews and merges the PR
4. `publish-release.yml` creates a GitHub Release with artifacts
Expand Down
14 changes: 12 additions & 2 deletions template/docs/pages/how-to/contribute.md.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -694,13 +694,23 @@ graph LR

### How It Works

1. **Tag a release:**
1. **Tag a release** (signed with [gitsign](https://github.com/sigstore/gitsign) keyless Sigstore signing):

```bash
git tag v0.2.0 -m "Release v0.2.0"
git tag -s v0.2.0 -m "Release v0.2.0"
git push origin v0.2.0
```

One-time gitsign setup so `git tag -s` signs via Sigstore, with no long-lived GPG key to manage:

```bash
git config --local gpg.x509.program gitsign
git config --local gpg.format x509
git config --local tag.gpgSign true
```

The first signing authenticates via your identity provider in a browser; verify a tag with `gitsign verify-tag`. Signed tags complement the PEP 740 artifact attestations the publish workflow already produces, so both the tag and the published artifacts are verifiable.

2. **Automated changelog workflow** (`changelog.yml`):
- Generates changelog from conventional commits using git-cliff
- Creates a **Pull Request** with the updated CHANGELOG.md
Expand Down