modulesync 4.5.0 → 4.6.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: d8ccf6e8a41d6921a17a4171187f6ee1a63478ac231125c5bede16e52e9a2082
-  data.tar.gz: 5e65db0d1e4c83cdcaa4bd6537bb2080f5318551ae6ce10cbb62c1897217910d
+  metadata.gz: 42cf2d8364d939be480302cbb0856e69df96468c5b35a460c29380dbb1455049
+  data.tar.gz: 93ee25b205bd960afe750188b5e1bf7c640aace8bdb91aac8345aed93d980a23
 SHA512:
-  metadata.gz: c16e333b6556c1141385a8d3e17c7a53c74b9fc74d648cdab58a655d8f055155c33ed37cb89d90ea16905b3b28ac9bb3fb98b520748ace87bd4a5dca85c33beb
-  data.tar.gz: fa3990dfd4ea5c958146832effa2292c5388b8100897a28d7548c3954c385da17fdb16cf1daf7c96aece91c951b69624106c4dcf487b36d17ab06cae67b6a775
+  metadata.gz: de6493978a435981fdc1b28bb0d937df4631f8eea6cdfe820bfb543b829a1c51d77672f31e510caaf18ef62754ead0988beab47040ad1ecc8c6e75723517d3fa
+  data.tar.gz: 46094244ce217f1e3dfbfd57d87b6aba64d0533dfe42b94d96ef48a66d2ef17dcc0cae9e24e08d54344bb0b9fa1553f1eb8898170489b0b79bfc9fab9acb5081

data/.github/workflows/ci.yml

@@ -16,16 +16,16 @@ jobs:
     outputs:
       ruby: ${{ steps.ruby.outputs.versions }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Setup ruby
-        uses: ruby/setup-ruby@6e5d382445ae5590b7449d8b3bc8cb1c2c27f617 # v1.317.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: "3.4"
           bundler-cache: true
       - name: Run linter
         run: bundle exec rake rubocop
       - id: ruby
-        uses: voxpupuli/ruby-version@656370e339050da63b86b1c631f5f88a3f4c0803 # 1.0.1
+        uses: voxpupuli/ruby-version@be0467ce7366d206b2e87f5b7a032a030120b7cb # 2.0.0
 
   test:
     name: "Ruby ${{ matrix.ruby }}"
@@ -36,9 +36,9 @@ jobs:
       matrix:
         ruby: ${{ fromJSON(needs.rubocop_and_matrix.outputs.ruby) }}
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Ruby ${{ matrix.ruby }}
-        uses: ruby/setup-ruby@6e5d382445ae5590b7449d8b3bc8cb1c2c27f617 # v1.317.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: ${{ matrix.ruby }}
           bundler-cache: true

data/.github/workflows/labeler.yml

@@ -14,4 +14,4 @@ jobs:
     permissions:
       pull-requests: write
     steps:
-      - uses: actions/labeler@b8dd2d9be0f68b860e7dae5dae7d772984eacd6d # v6.2.0
+      - uses: actions/labeler@bf12e9b00b37c5c0ca2b87b79b2daf7891dbda13 # v7.0.0

data/.github/workflows/release.yml

@@ -15,9 +15,9 @@ jobs:
     name: Build the gem
     runs-on: ubuntu-24.04
     steps:
-      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
       - name: Install Ruby
-        uses: ruby/setup-ruby@6e5d382445ae5590b7449d8b3bc8cb1c2c27f617 # v1.317.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: 'ruby'
       - name: Build gem
@@ -96,7 +96,7 @@ jobs:
         with:
           name: gem-artifact
       - name: Install Ruby
-        uses: ruby/setup-ruby@6e5d382445ae5590b7449d8b3bc8cb1c2c27f617 # v1.317.0
+        uses: ruby/setup-ruby@95ef2b042f9d7a56d8268cba8559e2842e2ad01b # v1.321.0
         with:
           ruby-version: 'ruby'
       - name: Wait for release to propagate

data/CHANGELOG.md

@@ -2,9 +2,17 @@
 
 All notable changes to this project will be documented in this file.
 
-## [4.5.0](https://github.com/voxpupuli/modulesync/tree/4.5.0) (2026-07-15)
+## [4.6.0](https://github.com/voxpupuli/modulesync/tree/4.6.0) (2026-07-31)
 
-[Full Changelog](https://github.com/voxpupuli/modulesync/compare/v4.4.0...4.5.0)
+[Full Changelog](https://github.com/voxpupuli/modulesync/compare/v4.5.0...4.6.0)
+
+**Implemented enhancements:**
+
+- feat: add support for cryptographic signing and signoff options in commits and tags [\#368](https://github.com/voxpupuli/modulesync/pull/368) ([rwaffen](https://github.com/rwaffen))
+
+## [v4.5.0](https://github.com/voxpupuli/modulesync/tree/v4.5.0) (2026-07-15)
+
+[Full Changelog](https://github.com/voxpupuli/modulesync/compare/v4.4.0...v4.5.0)
 
 **Implemented enhancements:**
 

data/README.md

@@ -166,6 +166,17 @@ Not required for gerrit.
 msync update --amend --force
 ```
 
+Use `--sign` to cryptographically sign commits and tags with Git's configured signing key and backend.
+ModuleSync only passes Git's signing flags (`git commit --gpg-sign` and `git tag --sign`).
+It does not configure the signing key, format, or backend; users must configure these settings in their Git configuration.
+Use `--signoff` to add Git's `Signed-off-by` trailer.
+The options can be combined and also apply to the release commit created by `--bump`.
+When combined with `--tag`, `--sign` creates signed annotated tags using `git tag --sign`.
+
+```shell
+msync update -m "Commit message" --sign --signoff
+```
+
 #### Automating Updates
 
 You can install a pre-push git hook to automatically clone, update, and push modules upon pushing changes to the configuration directory.
@@ -365,6 +376,12 @@ If you wish to tag the modified repositories with the newly bumped version, you
 msync update -m "Commit message" --bump --tag
 ```
 
+Add `--sign` to cryptographically sign both the release commit and tag:
+
+```shell
+msync update -m "Commit message" --bump --tag --sign
+```
+
 #### Setting the tag pattern
 
 You can also set the format of the tag to be used (`printf`-formatted) by setting the `tag_pattern` option:

data/features/cli.feature

@@ -28,6 +28,11 @@ Feature: CLI
       msync clone
     """
 
+  Scenario: Update help lists commit signing options
+    When I successfully run `msync update --help`
+    Then the output should match /--sign/
+    And the output should match /--signoff/
+
   Scenario: When overriding a setting from the config file on the command line
     Given a puppet module "puppet-test" from "fakenamespace"
     And a file named "managed_modules.yml" with:

data/lib/modulesync/cli.rb

@@ -88,6 +88,14 @@ module ModuleSync
              type: :boolean,
              desc: 'Amend previous commit',
              default: false
+      option :sign,
+             type: :boolean,
+             desc: 'Cryptographically sign commits and tags',
+             default: false
+      option :signoff,
+             type: :boolean,
+             desc: 'Add a Signed-off-by trailer to commits',
+             default: false
       option :force,
              type: :boolean,
              desc: 'Force push amended commit',

data/lib/modulesync/puppet_module.rb

@@ -25,13 +25,13 @@ module ModuleSync
       end
     end
 
-    def bump(message, changelog = false)
+    def bump(message, changelog = false, signing_options = {})
       m = Blacksmith::Modulefile.new path('metadata.json')
       new = m.bump!
       puts "Bumped to version #{new}"
       repository.git.add('metadata.json')
       update_changelog(new, message) if changelog
-      repository.git.commit("Release version #{new}")
+      repository.commit_changes("Release version #{new}", signing_options)
       repository.git.push
       new
     end

data/lib/modulesync/repository.rb

@@ -165,10 +165,10 @@ module ModuleSync
       end
     end
 
-    def tag(version, tag_pattern)
+    def tag(version, tag_pattern, sign: false)
       tag = tag_pattern % version
       puts "Tagging with #{tag}"
-      repo.add_tag(tag)
+      repo.add_tag(tag, sign: sign)
       repo.push('origin', tag)
     end
 
@@ -178,6 +178,19 @@ module ModuleSync
       selected_branch
     end
 
+    def commit_changes(message, options)
+      commit_options = {}
+      commit_options[:amend] = true if options[:amend]
+      commit_options[:gpg_sign] = true if options[:sign]
+      return repo.commit(message, commit_options) unless options[:signoff]
+
+      arguments = ["--message=#{message}"]
+      arguments.push('--amend', '--no-edit') if options[:amend]
+      arguments << '--gpg-sign' if options[:sign]
+      arguments << '--signoff'
+      repo.lib.send(:command, 'commit', *arguments)
+    end
+
     # Git add/rm, git commit, git push
     def submit_changes(files, options)
       message = options[:message]
@@ -190,8 +203,6 @@ module ModuleSync
         end
       end
       begin
-        opts_commit = {}
-        opts_commit = { amend: true } if options[:amend]
         if options[:pre_commit_script]
           script = "#{File.dirname(__FILE__, 3)}/contrib/#{options[:pre_commit_script]}"
           system(script, @directory)
@@ -200,7 +211,7 @@ module ModuleSync
           puts "There were no changes in '#{@directory}'. Not committing."
           return false unless @rebased
         else
-          repo.commit(message, opts_commit)
+          commit_changes(message, options)
         end
         if options[:remote_branch]
           if @rebased || remote_branch_differ?(branch, options[:remote_branch])

data/lib/modulesync/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module ModuleSync
-  VERSION = '4.5.0'
+  VERSION = '4.6.0'
 end

data/lib/modulesync.rb

@@ -151,8 +151,9 @@ module ModuleSync
       pushed = puppet_module.repository.submit_changes(files_to_manage, options)
       # Only bump/tag if pushing didn't fail (i.e. there were changes)
       if pushed && options[:bump]
-        new = puppet_module.bump(options[:message], options[:changelog])
-        puppet_module.repository.tag(new, options[:tag_pattern]) if options[:tag]
+        signing_options = { sign: options[:sign], signoff: options[:signoff] }
+        new = puppet_module.bump(options[:message], options[:changelog], signing_options)
+        puppet_module.repository.tag(new, options[:tag_pattern], sign: options[:sign]) if options[:tag]
       end
       options[:pr] && (pushed || puppet_module.pull_request_branch_ready?) && puppet_module.open_pull_request
     end

data/spec/unit/module_sync/repository_spec.rb

@@ -116,4 +116,35 @@ describe ModuleSync::Repository do
       expect(result).to be true
     end
   end
+
+  describe '#commit_changes' do
+    it 'signs the commit when requested' do
+      expect(git).to receive(:commit).with('Update', { gpg_sign: true })
+
+      repository.commit_changes('Update', sign: true, signoff: false)
+    end
+
+    it 'uses the Git signoff option when requested' do
+      expect(git_lib).to receive(:send)
+        .with(:command, 'commit', '--message=Update', '--signoff')
+
+      repository.commit_changes('Update', sign: false, signoff: true)
+    end
+
+    it 'combines amend, signing, and signoff options' do
+      expect(git_lib).to receive(:send)
+        .with(:command, 'commit', '--message=Update', '--amend', '--no-edit', '--gpg-sign', '--signoff')
+
+      repository.commit_changes('Update', amend: true, sign: true, signoff: true)
+    end
+  end
+
+  describe '#tag' do
+    it 'signs and pushes the tag when requested' do
+      expect(git).to receive(:add_tag).with('v1.2.3', sign: true)
+      expect(git).to receive(:push).with('origin', 'v1.2.3')
+
+      repository.tag('1.2.3', 'v%s', sign: true)
+    end
+  end
 end

data/spec/unit/module_sync_spec.rb

@@ -70,5 +70,17 @@ describe ModuleSync do
 
       described_class.manage_module(puppet_module, [], {})
     end
+
+    it 'passes signing options to a release commit and tag' do
+      options = described_class.config_defaults.merge(message: 'Update', bump: true, tag: true, sign: true, signoff: true)
+      described_class.instance_variable_set(:@options, options)
+      allow(repository).to receive(:submit_changes).and_return(true)
+      expect(puppet_module).to receive(:bump)
+        .with('Update', nil, { sign: true, signoff: true })
+        .and_return('1.2.3')
+      expect(repository).to receive(:tag).with('1.2.3', '%s', sign: true)
+
+      described_class.manage_module(puppet_module, [], {})
+    end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: modulesync
 version: !ruby/object:Gem::Version
-  version: 4.5.0
+  version: 4.6.0
 platform: ruby
 authors:
 - Vox Pupuli