ci: a release refuses an unsigned build

Captain Bob, 2026-11-12: "release MUST refuse unsigned builds". release.yml's
"The capsule-signing key" step warned when CAPSULE_SIGN_KEY was missing and the
release went on, unsigned. Now it is an ::error:: and the step fails, as the
gate into master's does (#174). build.yml and nightly.yml still warn.

scripts/test_acceptance_signing.sh now takes the step from both acceptance.yml
and release.yml as CI runs them. Against release.yml as it was: the release's
unsigned case passed, no error -- 2 failures (acceptance's 3 checks passed).
Now 6 checks, all pass. logs/20261112-205446/.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017RzZgrf7V7Zk2iczBXDRbm

.gitea/workflows/release.yml

@@ -39,6 +39,9 @@ jobs:
           fetch-depth: 0
           lfs: false
 
+      # A release refuses an unsigned build (Captain Bob, 2026-11-12: "release MUST refuse unsigned
+      # builds"), as the gate into master does (#174). It warned and went on.
+      # scripts/test_acceptance_signing.sh runs this step.
       - name: The capsule-signing key
         env:
           KEY: ${{ secrets.CAPSULE_SIGN_KEY }}
@@ -48,7 +51,8 @@ jobs:
             (umask 077; printf '%s\n' "$KEY" > "$f")
             echo "SIGN_KEY=$f" >> "$GITHUB_ENV"; echo "The capsules will be signed."
           else
-            echo "::warning::No CAPSULE_SIGN_KEY secret: the capsules are built unsigned."
+            echo "::error::No CAPSULE_SIGN_KEY secret: a release is not built unsigned."
+            exit 1
           fi
 
       - name: The tag names the tree's version

scripts/test_acceptance_signing.sh

@@ -1,9 +1,10 @@
 #!/usr/bin/env bash
 # SPDX-License-Identifier: LicenseRef-Starship-1.0
 # Copyright (c) 2023-2026 Robert A. James
-# test_acceptance_signing.sh -- #174: the PR gate into master refuses an unsigned build. The step
-# ".gitea/workflows/acceptance.yml: The capsule-signing key" is taken from the workflow as CI runs
-# it, and run here with and without CAPSULE_SIGN_KEY.
+# test_acceptance_signing.sh -- the gate into master (#174) and a release (Captain Bob, 2026-11-12:
+# "release MUST refuse unsigned builds") refuse an unsigned build. Each workflow's step "The
+# capsule-signing key" is taken from the workflow as CI runs it, and run here with and without
+# CAPSULE_SIGN_KEY.
 #
 # Prints PASS:/FAIL: per check and RESULT:; exits 0 only if every check passes.
 set -uo pipefail
@@ -12,27 +13,32 @@ T=$(mktemp -d)
 trap 'rm -rf "$T"' EXIT
 ok=1
 
-python3 - "$ROOT/.gitea/workflows/acceptance.yml" "$T/step.sh" <<'EOF' || { echo "FAIL: no 'The capsule-signing key' step in acceptance.yml"; exit 1; }
+check_workflow() {  # check_workflow <workflow> <job>
+    local wf=$1 job=$2 step="$T/$1.sh"
+    if ! python3 - "$ROOT/.gitea/workflows/$wf.yml" "$job" "$step" <<'EOF'
 import sys, yaml
-steps = yaml.safe_load(open(sys.argv[1]))["jobs"]["acceptance"]["steps"]
+steps = yaml.safe_load(open(sys.argv[1]))["jobs"][sys.argv[2]]["steps"]
 run = [s["run"] for s in steps if s.get("name") == "The capsule-signing key"]
 assert len(run) == 1
-open(sys.argv[2], "w").write(run[0])
+open(sys.argv[3], "w").write(run[0])
 EOF
+    then echo "FAIL: $wf: no 'The capsule-signing key' step in job $job"; ok=0; return; fi
 
-run_step() {  # run_step <key or empty>: the step's exit status; GITHUB_ENV and RUNNER_TEMP in $T
-    : > "$T/env"
-    KEY="$1" GITHUB_ENV="$T/env" RUNNER_TEMP="$T" bash -e "$T/step.sh" > "$T/out" 2>&1
+    run_step() { : > "$T/env"; KEY="$1" GITHUB_ENV="$T/env" RUNNER_TEMP="$T" bash -e "$step" > "$T/out" 2>&1; }
+
+    if run_step ""; then echo "FAIL: $wf: no CAPSULE_SIGN_KEY: the step passed -- an unsigned build would go on"; ok=0
+    else echo "PASS: $wf: no CAPSULE_SIGN_KEY: the step fails, the unsigned build is refused"; fi
+    grep -q "::error::" "$T/out" && echo "PASS: $wf: and says so as an error" || { echo "FAIL: $wf: no ::error:: line"; ok=0; }
+
+    if run_step "-----BEGIN PRIVATE KEY----- test -----END PRIVATE KEY-----" &&
+       grep -q "^SIGN_KEY=$T/capsule-signing.key$" "$T/env" && [ -s "$T/capsule-signing.key" ]; then
+        echo "PASS: $wf: with a key: the step passes and hands it to the build (SIGN_KEY)"
+    else echo "FAIL: $wf: with a key: the step did not pass, or did not set SIGN_KEY"; ok=0; fi
+    rm -f "$T/capsule-signing.key"
 }
 
-if run_step ""; then echo "FAIL: #174 no CAPSULE_SIGN_KEY: the step passed -- an unsigned build would be accepted"; ok=0
-else echo "PASS: #174 no CAPSULE_SIGN_KEY: the step fails, the gate refuses the unsigned build"; fi
-grep -q "::error::" "$T/out" && echo "PASS: #174 and says so as an error" || { echo "FAIL: #174 no ::error:: line"; ok=0; }
-
-if run_step "-----BEGIN PRIVATE KEY----- test -----END PRIVATE KEY-----" && grep -q "^SIGN_KEY=$T/capsule-signing.key$" "$T/env" &&
-   [ -s "$T/capsule-signing.key" ]; then
-    echo "PASS: with a key: the step passes and hands it to the build (SIGN_KEY)"
-else echo "FAIL: with a key: the step did not pass, or did not set SIGN_KEY"; ok=0; fi
+check_workflow acceptance acceptance       # the gate into master (#174)
+check_workflow release release             # a release
 
 echo "RESULT: $([ $ok = 1 ] && echo PASS || echo FAIL)"
 [ $ok = 1 ]