Add signed dev-to-master merge helper

[kristapsk]

Summary by CodeRabbit

Release Notes

• Chores
  • Added automated branch merge tooling with enhanced security validation to support the release process.

[coderabbitai]

Looking for one thing? Review this PR in Change Stack to search files, summaries, diffs, and code without losing your place.

Warning

Review limit reached

@kristapsk, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 4 minutes and 3 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more in the billing tab.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: c024c28c-d9f5-4846-903d-aeacc53f3230

📥 Commits

Reviewing files that changed from the base of the PR and between 9ab3674 and 62885e2.

📒 Files selected for processing (1)

• merge-dev-to-master.sh

Walkthrough

This PR introduces a new Bash script that safely merges a remote development branch into master. The script enforces clean repository state, validates branch histories, uses signed merge commits, optionally verifies all new commits are signed by GPG keys from an allow-list, and conditionally pushes the result.

Changes

Controlled dev-to-master merge workflow

Layer / File(s)	Summary
Configuration and argument parsing merge-dev-to-master.sh	Configuration variables define the remote, branch names, and GPG key directory; argument parsing handles --push and --help flags with usage output.
Utility functions and repository preconditions merge-dev-to-master.sh	Helper functions provide consistent error/info logging; precondition checks enforce a clean working tree and verify that required remote refs exist.
GPG key and signature allow-list framework merge-dev-to-master.sh	GPG validation loads permitted key IDs from *.asc files; extracts signing key IDs from commits; validates all commits in a range are signed by known keys; fails if any commit is unsigned or signed by an unknown key.
Merge workflow orchestration and optional push merge-dev-to-master.sh	Main flow fetches remotes, validates histories are compatible, merges dev into master with a signed commit, optionally verifies new commits with GPG when --push is set, pushes or prints instructions, and notes branch changes.

Estimated code review effort

🎯 4 (Complex) | ⏱️ ~75 minutes

Poem

A rabbit hops through branches, secure and swift,
Merging dev to master with a cryptographic gift,
Each commit signed and verified with care,
GPG keys and histories declared fair,
Safe automation, checked at every gate! 🐰✨

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and concisely describes the main addition: a Bash script for merging development to master with cryptographic signature verification.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@merge-dev-to-master.sh`:
- Line 33: The case pattern '-h|--help)' is missing spaces around the '|' which
fails shfmt; update the case entry (the pattern used in the case statement,
e.g., the '-h|--help)' pattern) to include spaces around the pipe like '-h |
--help)' (and similarly fix any other case patterns with '|' in the same script)
so the script conforms to shfmt formatting rules and CI passes.
- Around line 101-114: commit_signature_key_id currently extracts a key token
from `git log --show-signature` which can be 8/16/40 chars, while
key_id_is_allowed uses exact matches against ALLOWED_GPG_KEY_IDS; update
key_id_is_allowed (or normalize in commit_signature_key_id) to compare by
suffix/normalize lengths so different GPG outputs match: either strip to the
lower 16 chars of the fingerprint (or always compare trailing 16 chars) or
perform a suffix match (e.g., check if the commit key ends with an allowed ID)
and ensure functions named commit_signature_key_id and key_id_is_allowed (and
load_allowed_gpg_key_ids if present) use the same normalization strategy so
8/16/40-char variants all match allowed entries.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 8a4462a6-ebe9-4f8b-8f6d-1f5b8865d218

📥 Commits

Reviewing files that changed from the base of the PR and between a334744 and 9ab3674.

📒 Files selected for processing (1)

• merge-dev-to-master.sh

[Copilot]

Pull request overview

Adds a repository helper script to promote changes from dev to master with an option to push, aiming to ensure the resulting history is signed by known keys in the repo’s keys/*.asc.

Changes:

• Adds merge-dev-to-master.sh to fetch, fast-forward master, merge origin/dev with a signed merge commit, and optionally push.
• Introduces commit signature allow-list checking against public keys stored under keys/.
• Adds pre-flight checks for being in a Git repo and having a clean working tree before modifying branches.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 4 comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.