[ajianaz]

What

Part 2 of 4 of the release-signature reminder (part 1 is #1472, merged).

scripts/release-signature-reminder.sh now acts on the detection result:

• latest release unsigned: opens the issue Sign release vX.Y.Z (minisign) assigned to RELEASE_SIGNER (default ajianaz), or re-pings an existing one at most every REMINDER_AFTER_HOURS (default 12)
• latest release signed: closes the open reminder with a comment
• only issues and comments authored by the Actions bot or the signer are trusted, so nobody else can silence or spoof a reminder
• issues are listed without --search (the search index lags and caused duplicates)
• every mutation goes through mutate(), so --dry-run changes nothing

The test script grows with a stub gh that records mutations.

Why

Part 1 only says signed or unsigned. This part turns that into the actual nag and the self-closing, which is what keeps the offline signing step (scripts/sign-release.sh) from being forgotten.

Testing

• bash scripts/tests/release-signature-reminder.test.sh: all checks pass (create, re-ping before and after the interval, untrusted author ignored, close on signed, dry-run leaves no mutation, duplicate protection).
• bash -n is clean. No workflow is added yet (part 4), so nothing is scheduled by this PR.

[github-actions]

🔍 Cora AI Code Review

⚠️ Review could not complete. LLM API error after retries: LLM API returned status 504: {"is_bifrost_error":true,"status_code":504,"error":{"error":"fasthttp: timeout","type":"request_timed_out","message":"request timed out (default is 300 seconds). You can increase it by setting the default_request_timeout_in_seconds in the network_config or in UI - Providers \u003e Provider Name \u003e Network Config."},"extra_fields":{"routing_info":{"provider":"glm","model":"glm-5.3","key":"bt1"},"provider":"glm","original_model_requested":"glm-5.3","resolved_model_used":"glm-5.3","request_type":"chat_comp… [truncated]

---

Review powered by cora-code · BYOK · MIT

[ajianaz]

Merging on the owner's explicit approval: the Cora job hits the gateway's 300 s limit (504) on this diff, twice. Local review with the configured model (glm/glm-5.3, same rules, 560 s limit) completed: 0 blocking issues; 2 minor + 3 info. Triage: failing create/jq already aborts under set -e (no silent success); the duplicate-from-concurrent-runs case is covered by the concurrency group added in part 4; the listing-limit comment was corrected in the last commit; the trust-list and grep-BRE notes need no change (the script runs on ubuntu with the Actions bot identity). 15/15 CI checks pass, test script passes.