# Kolaboro log witness: copy this file to .github/workflows/kolaboro-witness.yml in YOUR repository, and copy
# kolaboro_witness.py (https://kolaboro.com/open/witness/kolaboro_witness.py) to witness/kolaboro_witness.py. Read the script first.
#
# One-time setup (about two minutes):
#   1. On your own computer:  python3 kolaboro_witness.py keygen witness.key
#      It prints your public key and writes the private seed to witness.key (never commit that file).
#   2. In your repository: Settings > Secrets and variables > Actions > New repository secret,
#      name KB_WITNESS_KEY, value = the content of witness.key. Then delete witness.key or keep it offline.
#   3. Run the workflow once by hand (Actions > Kolaboro log witness > Run workflow).
#
# Every day it downloads https://kolaboro.com/api/open/checkpoint, checks Kolaboro's signature, checks that the tree only grew
# since the checkpoint this repository saw last (RFC 9162 consistency proof against witness/state.json, which the job commits
# back), cosigns it with your key and submits the cosignature. If the log was ever rewritten, the job refuses to sign and FAILS:
# GitHub emails you, and the failed run with its output is your public evidence.
name: Kolaboro log witness
on:
  schedule:
    - cron: '41 8 * * *'   # daily, after Kolaboro's 07:15 UTC log line
  workflow_dispatch:
permissions:
  contents: write
concurrency:
  group: kolaboro-witness
  cancel-in-progress: false
jobs:
  witness:
    runs-on: ubuntu-latest
    timeout-minutes: 10
    steps:
      - uses: actions/checkout@v4
      - name: Verify the log and cosign
        env:
          KB_WITNESS_KEY: ${{ secrets.KB_WITNESS_KEY }}
        run: |
          python3 witness/kolaboro_witness.py run --name "github.com/${{ github.repository }}" \
            --state witness/state.json --submit --contact "https://github.com/${{ github.repository }}"
      - name: Keep what this witness saw
        run: |
          git config user.name "kolaboro-witness"; git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git add witness/state.json 2>/dev/null || exit 0
          git diff --cached --quiet || { git commit -q -m "witness: kolaboro.com/log $(date -u +%F)"; git push -q; }