djordjelukic1639080/cbx-example-git-signing:1

schemaVersion: "3"
displayName: Git commit signing
description: 'Signs git commits and tags with the user''s SSH key, through the SSH agent cbx exposes in the sandbox. The agent may make git signatures and nothing else: no logins, no other namespaces.'
version: 1.0.0
kind: mixin
provides:
    - [email protected]
capabilities:
    - group:
        name: git-signing
        optional: true
        capabilities:
            - type: com.docker.sandbox/ssh-agent@1
              config:
                phase: runtime
                sign:
                    - git
                unrestricted: false
              description: Sign git commits and tags with the user's SSH key
            - type: com.docker.sandbox/lifecycle@1
              config:
                files:
                    - content: |
                        [gpg]
                          format = ssh
                        [gpg "ssh"]
                          defaultKeyCommand = ssh-add -L
                        [commit]
                          gpgsign = true
                        [tag]
                          gpgsign = true
                      description: Sign commits and tags with the agent's key
                      overwrite: false
                      path: ${{ kit.env.HOME }}/.config/git/config
            - type: com.docker.sandbox/agent-context@1
              config:
                content: |
                    Commits and tags you make are signed with the user's SSH key through
                    the agent at $SSH_AUTH_SOCK; you do not need -S. The agent signs git
                    signatures only and refuses logins and anything else, so do not use
                    it for ssh. If `ssh-add -L` finds no agent or no keys, signing is
                    unavailable: commit with --no-gpg-sign and tell the user. A signed
                    commit does not mean the user reviewed it; say which commits you
                    made.