feat(git): enable opt-in SSH commit and tag signing

Author: WhatIsHeDoing

ansible/inventory/group_vars/local.yml.example

@@ -3,3 +3,9 @@
 # Copy this file to local.yml (gitignored) and fill in your details.
 git_user_name: "Your Name"
 git_user_email: "you@example.com"
+
+# SSH public key used to sign commits and tags (enables "Verified" badges).
+# Works with the Bitwarden SSH agent already wired up in .zshrc. Get the key
+# from Bitwarden, or run: cat ~/.ssh/id_ed25519.pub
+# Leave this commented out to skip commit signing entirely.
+# git_signing_key: "ssh-ed25519 AAAA... you@example.com"

ansible/roles/git/tasks/main.yml

@@ -35,11 +35,26 @@
         value: "{{ git_user_email }}"
   when: git_user_name is defined and git_user_email is defined
 
+- name: Configure SSH commit and tag signing
+  community.general.git_config:
+      name: "{{ item.key }}"
+      value: "{{ item.value }}"
+      scope: global
+  loop:
+      - key: "gpg.format"
+        value: "ssh"
+      - key: "user.signingkey"
+        value: "{{ git_signing_key }}"
+      - key: "commit.gpgsign"
+        value: "true"
+      - key: "tag.gpgsign"
+        value: "true"
+  when: git_signing_key is defined
+
 - name: Reminder about git signing
   ansible.builtin.debug:
       msg: |
-          Git signing is not managed automatically. See principle 12.
-          To enable SSH signing:
-            git config --global gpg.format ssh
-            git config --global user.signingkey ~/.ssh/<key>.pub
-            git config --global commit.gpgsign true
+          Git signing is not enabled. Set git_signing_key in
+          ansible/inventory/group_vars/local.yml to your SSH public key
+          (e.g. from Bitwarden) to sign commits and tags automatically.
+  when: git_signing_key is not defined

cspell.yaml

@@ -24,6 +24,7 @@ words:
     - asciinema
     - atuin
     - binstall
+    - Bitwarden
     - bootstrapper
     - cask
     - checkov