From 4ca6c2c044243a0111e73efe592787037df87a07 Mon Sep 17 00:00:00 2001
From: ajianaz <ajianaz@users.noreply.github.com>
Date: Thu, 15 Oct 2026 12:58:23 +0700
Subject: [PATCH] ci(release): run the signature reminder after Release and
 every 6 hours (#1327)

---
 .../workflows/release-signature-reminder.yml  | 47 +++++++++++++++++++
 AGENTS.md                                     | 12 +++++
 CHANGELOG.md                                  |  4 ++
 3 files changed, 63 insertions(+)
 create mode 100644 .github/workflows/release-signature-reminder.yml

diff --git a/.github/workflows/release-signature-reminder.yml b/.github/workflows/release-signature-reminder.yml
new file mode 100644
index 00000000..e8ba80a0
--- /dev/null
+++ b/.github/workflows/release-signature-reminder.yml
@@ -0,0 +1,47 @@
+name: Release Signature Reminder
+
+# Opens (and re-pings) a "Sign release vX.Y.Z (minisign)" issue while the latest
+# release has no checksums-sha256.txt.minisig, and closes it once the signature
+# is uploaded. It signs nothing and holds no signing secret: the minisign key
+# stays offline (scripts/sign-release.sh, AGENTS.md "Release procedure" step 6).
+#
+# workflow_run is used because a release created with GITHUB_TOKEN does not
+# trigger `release` events; the schedule re-pings and notices the signature.
+
+on:
+  workflow_run:
+    workflows: ["Release"]
+    types: [completed]
+  schedule:
+    - cron: "17 */6 * * *"
+  workflow_dispatch:
+
+concurrency:
+  group: release-signature-reminder
+  cancel-in-progress: false
+
+permissions:
+  contents: read
+  issues: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  remind:
+    name: Remind to sign
+    if: github.event_name != 'workflow_run' || github.event.workflow_run.conclusion == 'success'
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Check the latest release for a signature
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          RELEASE_SIGNER: ajianaz
+          REMINDER_AFTER_HOURS: "12"
+        run: bash scripts/release-signature-reminder.sh
diff --git a/AGENTS.md b/AGENTS.md
index e528f309..11ecf184 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -95,6 +95,18 @@ Rust workspace: uteke-core (engine), uteke-cli, uteke-server, uteke-mcp, docgen.
    (stub gh/cosign, throwaway key; not wired into CI). Verify the
    `.minisig` is on the release before announcing. Until it is uploaded,
    `uteke upgrade` fails closed for that release (#1327).
+   Reminder: `.github/workflows/release-signature-reminder.yml` runs after the
+   Release workflow and every 6 hours. While the latest release has a bundle but no
+   `.minisig` it opens the issue `Sign release vX.Y.Z (minisign)` (assigned to the
+   owner), re-pings it every 12 h and closes it itself once the `.minisig` is
+   uploaded. Reminders for older releases are closed automatically, as superseded
+   (`uteke upgrade` only installs the latest release) or when their `.minisig`
+   appears. "Latest" follows GitHub's definition (by creation date, the same release
+   `uteke upgrade` installs), so a backport patch published after a newer minor
+   supersedes the newer release's reminder. Only issues and comments authored by the
+   Actions bot or the owner are acted on. It signs nothing and holds no key. Test its
+   script with `bash scripts/tests/release-signature-reminder.test.sh` (stub gh, not
+   wired into CI).
 7. **After the tag.** Merge the homebrew-tap PR the workflow opened (its title/body
    follow the tap's rules since #1384, and the job already re-verified every SHA256
    against `checksums-sha256.txt`; Cora there was fixed in homebrew-tap#6), then
diff --git a/CHANGELOG.md b/CHANGELOG.md
index ed29298f..210c1ddf 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -11,6 +11,10 @@
 - **`ORT_LIB_PATH` pointing at a directory no longer leaves uteke without embeddings (#1459)** - the Homebrew shims exported the `libexec` directory (v0.19.0 onwards), `dlopen` failed on it, and every such install silently stored memories FTS5-only (`embedding_written: false`, `uteke verify` MISMATCH). A directory that holds the platform library (`libonnxruntime.so`, `libonnxruntime.dylib` or `onnxruntime.dll`) is now accepted with a warning; a directory without it is a clear error that says to set the library file. The tap fix is codecoradev/homebrew-tap#10 (`brew update && brew reinstall codecoradev/tap/uteke`). Docker and the release tarballs were not affected.
 - **CLI log lines no longer corrupt `--json` output (#1461)** - the console log layer wrote to stdout, so any WARN or ERROR (for example a failed embedding) was printed in front of the command's JSON and `json.loads(stdout)` failed. Console logs now go to stderr; the log file and the command output are unchanged.
 
+### Changed
+
+- Internal: `release-signature-reminder` workflow and script open and re-ping a `Sign release vX.Y.Z (minisign)` issue until the offline minisign signature is on the release, and close reminders for superseded releases automatically (#1327).
+
 ## [0.21.0] - 2026-10-13
 
 Minor release. Theme: **honest recall feedback, one access policy for MCP over