require-signed-release: write the way forward on an unsigned verdict

An unsigned verdict rehearses instead of failing, but the notice names no concrete next step.
The opt-in unsigned-guidance input puts the exact companion commands into the step summary: fetch the tag, sign the companion on the release commit, push it.
The companion's name derives from the attestation-tags glob, so v*-sig suggests vX.Y.Z-sig and the default glob suggests <tag>-sig.
Pipelines that print their own guidance keep the plain notice.

Author: gronke

.github/actions/require-signed-release/action.yml

@@ -45,6 +45,15 @@ inputs:
       automation and must never act on a draft.
     required: false
     default: "false"
+  unsigned-guidance:
+    description: >-
+      "true": an unsigned verdict also writes the way forward into the step
+      summary — the exact commands that create and push the signed companion
+      on the release commit, its name derived from `attestation-tags`
+      (v*-sig suggests vX.Y.Z-sig; the default glob suggests <tag>-sig).
+      Off by default for pipelines that print their own guidance.
+    required: false
+    default: "false"
   attestation-tags:
     description: >-
       Glob another tag must match to count as an attestation (e.g. v*-sig).
@@ -110,6 +119,7 @@ runs:
         INPUT_ATTESTATION_TAG: ${{ inputs.attestation-tag }}
         INPUT_REQUIRE_PUBLISHED: ${{ inputs.require-published }}
         INPUT_ATTESTATION_TAGS: ${{ inputs.attestation-tags }}
+        INPUT_UNSIGNED_GUIDANCE: ${{ inputs.unsigned-guidance }}
         INPUT_ACCEPT_RELEASE_TAG: ${{ inputs.accept-release-tag }}
         INPUT_ACCEPT_ATTESTATION_TAG: ${{ inputs.accept-attestation-tag }}
         INPUT_ACCEPT_SIGNED_COMMIT: ${{ inputs.accept-signed-commit }}

.github/actions/require-signed-release/require-signed-release.sh

@@ -195,4 +195,27 @@ if [ "${INPUT_ACCEPT_SIGNED_COMMIT:-false}" = "true" ]; then
 fi
 
 echo "::notice::no verified signature for ${TAG} on ${COMMIT} — sign the release tag, push a signed tag on that commit, or (opt-in) sign the commit; until then the registry step rehearses instead of uploading"
+
+# Opt-in: put the way forward where the release manager is already
+# looking, with the companion's name derived from the attestation glob.
+if [ "${INPUT_UNSIGNED_GUIDANCE:-false}" = "true" ] && [ -n "${GITHUB_STEP_SUMMARY:-}" ]; then
+  GLOB="${INPUT_ATTESTATION_TAGS:-*}"
+  if [ "$GLOB" = "*" ]; then
+    COMPANION="${TAG}-sig"
+  else
+    COMPANION="${GLOB/\*/${TAG#v}}"
+  fi
+  {
+    echo "**Rehearsal only**: no verified signature covers \`${TAG}\` on \`${COMMIT}\`."
+    echo ""
+    echo "To publish, sign and push the companion on the release commit:"
+    echo ""
+    echo '```sh'
+    echo "git fetch origin tag ${TAG}"
+    echo "git tag -s -m '${TAG}' ${COMPANION} ${COMMIT}"
+    echo "git push origin ${COMPANION}"
+    echo '```'
+  } >> "$GITHUB_STEP_SUMMARY"
+fi
+
 write_outputs false "" "" "$COMMIT" "$TAG"

CHANGELOG.md

@@ -8,6 +8,7 @@ The format follows [Keep a Changelog](https://keepachangelog.com); releases are
 ### Added
 
 - `publish-dry-run` gains multi-crate release support: the expected version also derives from `<package>-vX.Y.Z` tags, and the new `require-deps-published` input fails a release tagged before its workspace path dependencies are live on crates.io, with an error naming the fix. The prep step now builds the `.crate` and pre-fetches its packaged lockfile, so the sealed offline verify-build resolves co-developed dependencies instead of failing even on a correctly ordered release, and the sealed step lists the shipped files via `cargo package --list`.
+- `require-signed-release` gains an opt-in `unsigned-guidance` input: an unsigned verdict also writes the way forward into the step summary — the exact commands that create and push the signed companion on the release commit, its name derived from `attestation-tags`. The `::notice::` alone stays the default for pipelines that print their own guidance.
 
 ## [1.6.1] - 2026-08-22