From d7204f0f6e96511e0d5d6cf849ff1e302edfb4af Mon Sep 17 00:00:00 2001
From: Darren Hickling <darrenhickling@hotmail.com>
Date: Fri, 26 Jun 2026 18:36:24 +0100
Subject: [PATCH] feat(git): enable opt-in SSH commit and tag signing

Wire user.signingkey to an SSH public key (e.g. from the Bitwarden
agent) and turn on commit.gpgsign/tag.gpgsign. Gated on git_signing_key
so commits never break when no key is configured; documented in
local.yml.example.
---
 .../inventory/group_vars/local.yml.example    |  6 +++++
 ansible/roles/git/tasks/main.yml              | 25 +++++++++++++++----
 cspell.yaml                                   |  1 +
 3 files changed, 27 insertions(+), 5 deletions(-)

diff --git a/ansible/inventory/group_vars/local.yml.example b/ansible/inventory/group_vars/local.yml.example
index 3c94c1c..6ccbb24 100644
--- a/ansible/inventory/group_vars/local.yml.example
+++ b/ansible/inventory/group_vars/local.yml.example
@@ -3,3 +3,9 @@
 # Copy this file to local.yml (gitignored) and fill in your details.
 git_user_name: "Your Name"
 git_user_email: "you@example.com"
+
+# SSH public key used to sign commits and tags (enables "Verified" badges).
+# Works with the Bitwarden SSH agent already wired up in .zshrc. Get the key
+# from Bitwarden, or run: cat ~/.ssh/id_ed25519.pub
+# Leave this commented out to skip commit signing entirely.
+# git_signing_key: "ssh-ed25519 AAAA... you@example.com"
diff --git a/ansible/roles/git/tasks/main.yml b/ansible/roles/git/tasks/main.yml
index 12d1a22..fef092c 100644
--- a/ansible/roles/git/tasks/main.yml
+++ b/ansible/roles/git/tasks/main.yml
@@ -35,11 +35,26 @@
         value: "{{ git_user_email }}"
   when: git_user_name is defined and git_user_email is defined
 
+- name: Configure SSH commit and tag signing
+  community.general.git_config:
+      name: "{{ item.key }}"
+      value: "{{ item.value }}"
+      scope: global
+  loop:
+      - key: "gpg.format"
+        value: "ssh"
+      - key: "user.signingkey"
+        value: "{{ git_signing_key }}"
+      - key: "commit.gpgsign"
+        value: "true"
+      - key: "tag.gpgsign"
+        value: "true"
+  when: git_signing_key is defined
+
 - name: Reminder about git signing
   ansible.builtin.debug:
       msg: |
-          Git signing is not managed automatically. See principle 12.
-          To enable SSH signing:
-            git config --global gpg.format ssh
-            git config --global user.signingkey ~/.ssh/<key>.pub
-            git config --global commit.gpgsign true
+          Git signing is not enabled. Set git_signing_key in
+          ansible/inventory/group_vars/local.yml to your SSH public key
+          (e.g. from Bitwarden) to sign commits and tags automatically.
+  when: git_signing_key is not defined
diff --git a/cspell.yaml b/cspell.yaml
index 569db5d..2ecf121 100644
--- a/cspell.yaml
+++ b/cspell.yaml
@@ -23,6 +23,7 @@ words:
     - asciinema
     - atuin
     - binstall
+    - Bitwarden
     - bootstrapper
     - cask
     - checkov