feat: pin client GPG trust and publish signed Git/Gist key releases

.github/workflows/deploy.yml

@@ -9,16 +9,40 @@ concurrency:
   group: production-key-release
   cancel-in-progress: false
 jobs:
+  verify:
+    # Repository Actions variables, not production environment variables: this
+    # job deliberately has no production environment or production secrets.
+    # The workflow/verifier themselves must be protected against modification.
+    if: github.ref == 'refs/heads/main' && vars.ENABLE_WORKER_DEPLOY == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Check exact checkout and optional pinned GPG commit signature
+        run: node scripts/verify-commit-signature.mjs
+        env:
+          REQUIRE_GPG_SIGNATURE: ${{ vars.REQUIRE_GPG_SIGNATURE }}
+          GPG_ALLOWED_PRIMARY_FINGERPRINTS: ${{ vars.GPG_ALLOWED_PRIMARY_FINGERPRINTS }}
+          GPG_PUBLIC_KEYS: ${{ vars.GPG_PUBLIC_KEYS }}
   deploy:
+    needs: verify
     # Deliberate opt-in prevents accidental deployment when this PR is merged.
-    # Configure production credentials and real server keys before enabling.
+    # Both push and workflow_dispatch must pass the same verification job.
     if: github.ref == 'refs/heads/main' && vars.ENABLE_WORKER_DEPLOY == 'true'
     runs-on: ubuntu-latest
     timeout-minutes: 15
     environment: production
+    outputs:
+      attempted: ${{ steps.deploy.outputs.attempted }}
+      deployment_outcome: ${{ steps.deploy.outcome }}
+      verification_outcome: ${{ steps.remote.outcome }}
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
+          ref: ${{ github.sha }}
           persist-credentials: false
       - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
         with:
@@ -27,12 +51,13 @@ jobs:
       - run: npm ci
       - name: Install shell test interpreters
         run: |
-          if ! command -v busybox >/dev/null || ! command -v shellcheck >/dev/null; then
+          if ! command -v busybox >/dev/null || ! command -v shellcheck >/dev/null || ! command -v gpg >/dev/null; then
             sudo apt-get update
-            sudo apt-get install -y busybox-static shellcheck
+            sudo apt-get install -y busybox-static shellcheck gnupg
           fi
           busybox sh -c 'echo "BusyBox shell ready"'
           shellcheck --version
+          gpg --version
       - run: npm test
         env:
           BROWSER_TESTS: '1'
@@ -40,9 +65,34 @@ jobs:
         run: npm run build
       - run: node scripts/verify-release.mjs
       - name: Deploy the validated production bundle
-        run: npx wrangler deploy --config cf-worker/wrangler.toml
+        id: deploy
+        run: |
+          echo 'attempted=true' >> "$GITHUB_OUTPUT"
+          npx wrangler deploy --config cf-worker/wrangler.toml
         env:
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}
           CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
       - name: Verify published revision and public key payload
+        id: remote
         run: node scripts/verify-release.mjs --remote
+  notify:
+    needs: [verify, deploy]
+    # Runs only after Wrangler was attempted, including deployment/remote-check
+    # failure. Gist edits alone do not trigger this workflow or an email.
+    if: always() && needs.verify.result == 'success' && needs.deploy.outputs.attempted == 'true'
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    environment: production
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          ref: ${{ github.sha }}
+          persist-credentials: false
+      - name: Send optional deployment email-provider webhook
+        run: node scripts/notify-deployment.mjs
+        env:
+          ENABLE_MAIL_NOTIFICATION: ${{ vars.ENABLE_MAIL_NOTIFICATION }}
+          MAIL_NOTIFICATION_WEBHOOK: ${{ secrets.MAIL_NOTIFICATION_WEBHOOK }}
+          MAIL_NOTIFICATION_TO: ${{ vars.MAIL_NOTIFICATION_TO }}
+          DEPLOYMENT_STATUS: ${{ needs.deploy.result }}
+          DEPLOYMENT_PHASE: ${{ needs.deploy.outputs.deployment_outcome != 'success' && 'deployment' || needs.deploy.outputs.verification_outcome != 'success' && 'remote-verification' || 'complete' }}