GH#34762: fix(release): discard failed signing-key API output

[vladimirdulov]

Summary

Resolves #34762.

• _release_signing_registered_keys (.agents/scripts/release-signing-helper.sh) now captures the private user/<kind> response and prints it only on success. A failed request can no longer leak its error body into the stdout consumed by the signing-key jq filters.
• .agents/scripts/tests/test-release-signing-preflight.sh stubs the failing private endpoint with the real gh shape (slurped error body plus exit 1). It then asserts that the successful SSH and GPG public fallbacks print nothing to stderr.
• Key-registration checks and fail-closed signing behaviour are unchanged.

Root cause (verified)

• Release-run call sites match the three reported error positions: full-loop-release-helper.sh:777, version-manager.sh:620, version-manager-release.sh:357. aidevops release status does not call the preflight, which explains why it stayed quiet.
• Without the admin:ssh_signing_key scope, the real binary (/opt/homebrew/bin/gh 2.102.0) handles gh api --paginate --slurp user/ssh_signing_keys like this:
  • It exits 1.
  • It still writes [{"message":"Not Found",...,"status":"404"}] to stdout.
• The old if gh api ...; then let that stdout through, and the public fallback pages were appended after it. jq -er '.[][] | .key' then printed Cannot index string with string ("key") at <stdin>:1. jq 1.8.2 still exits 0 because the later input succeeds, so the release continued as reported.
• The aidevops runtime-bundle gh shim swallows that stdout. That is why the error appears in terminal aidevops release runs but not under the agent shim.

Verification (exact head 22447c5535)

• bash .agents/scripts/tests/test-release-signing-preflight.sh: 4/4 PASS. With the pre-fix helper restored, it fails with FAIL successful public SSH fallback emitted diagnostics, so the regression detects the bug.
• shellcheck on both changed scripts: clean.
• Existing suites test-version-manager-*.sh + test-full-loop-release-*.sh: 23/24 pass. test-version-manager-aggregate-recovery.sh fails identically with origin/main's helper. That suite sets GIT_CONFIG_GLOBAL=/dev/null and does not stub the GH#34664 preflight, so it stops at "configure an explicit user.signingkey" before the changed function is reached. This is pre-existing and unrelated, and is tracked as a follow-up.
• Live preflight with the operator's real SSH signing config: passes, with no stderr.

Runtime Testing

runtime-verified: ran release_signing_preflight against the live GitHub API with the real SSH signing key (private endpoint 404 → public fallback). It matched the registered key with clean stderr. No release was published.

---

aidevops.sh v3.39.32 plugin for OpenCode v1.19.0 with claude-opus-5-5 spent 8m and 11,109 tokens on this with the user in an interactive session.

[coderabbitai]

Important

Review skipped

Auto reviews are limited based on label configuration.

🏷️ Required labels (at least one): 1

🚫 Excluded labels (none allowed): 1

• no-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Repository: marcusquinn/aidevops/.coderabbit.yaml
• Review profile: CHILL
• Plan: Advanced
• Run ID: fd198840-2f9a-4064-965a-ddc06ca82a80

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[github-actions]

Shell Function Complexity Regression Gate

✅ No regression — no new function(s) >100 lines.

Metric	Base (f58464b)	Head (22447c5)
Total function(s) >100 lines	0	0

[github-actions]

Bash 3.2 Compatibility Regression Gate

✅ No regression — no new bash 3.2-incompatible construct(s).

Metric	Base (f58464b)	Head (22447c5)
Total bash 3.2-incompatible construct(s)	0	0

[github-actions]

Qlty Smell Regression Gate

✅ No change — smell count unchanged.

Metric	Base (f58464b)	Head (22447c5)	Delta
Total smells	65	65	+0

[vladimirdulov]

Verification checkpoint — blocked on runner capability

• Issue: fix(release): unsuppressed jq 'Cannot index string with string "key"' noise on the release run path #34762. Pushed head: 34d5c5bb0bae6e3444fcf92fae8167fed63b205c.
• Implementation: .agents/scripts/release-signing-helper.sh buffers private API stdout and emits it only on success, discarding failed-request JSON before the public fallback. Registration enforcement is unchanged.
• Regression: .agents/scripts/tests/test-release-signing-preflight.sh reproduces failed-request JSON and asserts successful SSH/GPG fallback stderr is empty. It failed before the fix and passes afterward; existing wrong-key, unavailable-API and publication-preflight rejection checks pass.
• Passed: Bash syntax on both changed scripts, git diff --check, signing preflight, and 12 of 24 existing version-manager/full-loop-release scripts.
• Unmet: direct ShellCheck cannot run because its wrapper finds no real binary; no .aidevops.json verification command or worktree-local .venv/bin/shellcheck is available. The other 12 release scripts stop on unchanged hard-coded system-tool paths. Representative evidence: test-version-manager-release-provenance.sh:9-15, test-full-loop-release-helper.sh:184, test-full-loop-release-reconcile-command.sh:90. These are runner incompatibilities outside this fix, not repaired here.
• Resume: retain this draft and commit; run ShellCheck on both files plus the signing and release suites on a capable runner, update this exact-head summary, mark ready, check remote gates once, and invoke full-loop-helper.sh merge 34763 once. No release publication is authorized or performed.

---

aidevops.sh v3.39.31 plugin for OpenCode v1.19.0 with gpt-6.1-sol spent 5m and 78,571 tokens on this as a headless worker.

[github-actions]

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

SonarCloud: 0 bugs, 0 vulnerabilities, 1 code smells

Thu Oct 15 04:38:15 UTC 2026: Code review monitoring started
Thu Oct 15 04:38:16 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 1
Thu Oct 15 04:40:52 UTC 2026: Codacy analysis completed - issues found (exit 2)

📈 Current Quality Metrics

• BUGS: 0
• CODE SMELLS: 1
• VULNERABILITIES: 0

Generated on: Thu Oct 15 04:40:53 UTC 2026

---

Generated by AI DevOps Framework Code Review Monitoring

[github-actions]

Shell Nesting Depth Regression Gate

✅ No regression — no new file(s) with nesting depth >8.

Metric	Base (f58464b)	Head (22447c5)
Total file(s) with nesting depth >8	0	0

[github-actions]

File Size Regression Gate

✅ No regression — no new non-README Markdown file(s) >1000 lines at root / >500 elsewhere.

Metric	Base (f58464b)	Head (22447c5)
Total non-README Markdown file(s) >1000 lines at root / >500 elsewhere	0	0

[alex-solovyev]

Auto-approved by pulse runner @alex-solovyev — author @vladimirdulov confirmed collaborator, pre-merge gates passed.

[alex-solovyev]

Auto-approved by pulse runner @alex-solovyev — author @vladimirdulov confirmed collaborator, pre-merge gates passed.

---

aidevops.sh v3.39.32 automated scan.

[github-actions]

🔍 Code Quality Report

�[0;35m[MONITOR]�[0m Code Review Monitoring Report

SonarCloud: 0 bugs, 0 vulnerabilities, 1 code smells

Thu Oct 15 17:39:59 UTC 2026: Code review monitoring started
Thu Oct 15 17:40:00 UTC 2026: SonarCloud - Bugs: 0, Vulnerabilities: 0, Code Smells: 1
Thu Oct 15 17:42:28 UTC 2026: Codacy analysis completed - issues found (exit 2)

📈 Current Quality Metrics

• BUGS: 0
• CODE SMELLS: 1
• VULNERABILITIES: 0

Generated on: Thu Oct 15 17:42:29 UTC 2026

---

Generated by AI DevOps Framework Code Review Monitoring