From bb59d6d257194e2e4a00ecd85965a73a2371e11a Mon Sep 17 00:00:00 2001
From: Torgny Bjers <torgny@bjers.org>
Date: Thu, 2 Jul 2026 14:33:04 -0400
Subject: [PATCH] ci: switch to GITHUB_TOKEN signing

---
 .github/workflows/export-docs.yml | 14 ++++----------
 1 file changed, 4 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/export-docs.yml b/.github/workflows/export-docs.yml
index f6d5f17..b749c73 100644
--- a/.github/workflows/export-docs.yml
+++ b/.github/workflows/export-docs.yml
@@ -17,15 +17,13 @@ on:
   workflow_dispatch:
 
 permissions:
-  contents: read
+  id-token: write
+  contents: write
+  pull-requests: write
 
 jobs:
   export:
     runs-on: ubuntu-latest
-    permissions:
-      id-token: write
-      contents: write
-      pull-requests: write
     steps:
       - name: Checkout coveragetracker.dev
         uses: actions/checkout@v4
@@ -34,7 +32,6 @@ jobs:
         uses: actions/checkout@v4
         with:
           repository: CoverageTracker/coverage-tracker
-          token: ${{ secrets.COVERAGE_TRACKER_SYNC_TOKEN }}
           path: target-repo
 
       - name: Setup Node
@@ -45,17 +42,14 @@ jobs:
       - name: Export docs
         run: node --experimental-strip-types scripts/export-docs.ts target-repo
 
-      - name: Setup Git Sign
-        uses: chainguard-dev/actions/setup-gitsign@f0be69916b439d0fcced2451b23d0f27cd46d545 # v1.6.26
-
       # Fixed branch name so repeated runs update the same PR; skips cleanly
       # (no commit, no PR) when the export produced no diff.
       - name: Open or update sync PR
         uses: peter-evans/create-pull-request@v7
         with:
           path: target-repo
-          token: ${{ secrets.COVERAGE_TRACKER_SYNC_TOKEN }}
           branch: docs-sync
+          sign-commits: true
           commit-message: 'docs: sync generated docs from coveragetracker.dev'
           title: 'docs: sync generated docs from coveragetracker.dev'
           body: |