sign-manifests.yml

name: Sign KCP manifests

on:
  push:
    branches: [main, master]
    paths:
      - 'knowledge.yaml'
  workflow_dispatch:

jobs:
  sign:
    runs-on: ubuntu-latest
    if: "!contains(github.event.head_commit.message, '[skip-sign]')"
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4

      - name: Checkout KCP CLI
        uses: actions/checkout@v4
        with:
          repository: Cantara/knowledge-context-protocol
          path: kcp-spec

      - uses: actions/setup-node@v4
        with:
          node-version: '24'
          cache: 'npm'
          cache-dependency-path: kcp-spec/cli/package-lock.json

      - name: Build KCP CLI
        run: |
          cd kcp-spec/cli
          npm ci
          npm run build

      - name: Restore signing key
        env:
          KCP_SIGNING_KEY: ${{ secrets.KCP_SIGNING_KEY }}
        run: |
          printf '%s' "$KCP_SIGNING_KEY" > /tmp/kcp-signing.pem
          chmod 600 /tmp/kcp-signing.pem

      - name: Sign knowledge.yaml
        run: |
          node kcp-spec/cli/dist/cli.js sign knowledge.yaml \
            --key /tmp/kcp-signing.pem \
            --key-id cantara-repos-2026 \
            --update-hashes \
            --out knowledge.yaml.sig

      - name: Commit signed manifest
        run: |
          git config user.name  "kcp-bot[bot]"
          git config user.email "actions@cantara.no"
          git add knowledge.yaml knowledge.yaml.sig
          if git diff --staged --quiet; then
            echo "Nothing changed -- skipping commit"
          else
            git commit -m "chore: refresh KCP manifest signatures [skip-sign]"
            git push
          fi