Feature: provide possibility to add custom content to signer automation

[kommendorkapten]

Today when a signing event happens the automation prints information like:

Signers can sign these changes by running tuf-on-ci-sign sign/root-v10

It would be a nice feature if each repository can add custom information on what to be displayed.

A solution could support data that is either complementary or replaces the output entirely.

[jku]

That might make sense. That said I'd like to resist fixing things by making them customizable until we have established that the issue can't be fixed otherwise (the cost of customizability is paid by everyone but the benefits only go to the customizer).

[jku]

From #176:

There are two separate cases here:

1. Signing event: Maybe a custom text that is included in the first comment of each signing event ? Or every update?
   • this can be used as "documentation": remind signers of repository processes or something
   • this can also be used for notification: signers get mentioned automatically but maybe repository maintainers want to add a team mention or something like it?
2. Error notification: After feature: Add integrated issue handling #176 workflow failures lead to an issue being filed (each subsequent failure leads to a comment in that issue). Here we probably want to include custom content in each comment? Do we want different custom content for different workflows (online-sign vs create-signing-events)?
   • This content could be used document the urgency: how fast will clients break if issue is not resolved
   • This could be used to notify maintainers or teams

I can see at least two potential ways to implement:

• define repository variables like TUF_ON_CI_CUSTOM_FAILURE_MESSAGE
• or read the content from files in git repo like .tuf-on-ci/custom_failure.md

[kommendorkapten]

Signing event

I think it should be with every update, I'm in favour of a bit extra "nagging" to make sure the message comes through. For larger repos with many keyholders, there is a risk that the first message is not read thoroughly.

I like the idea of having two files:

• .tuf-on-ci/custom_message.md
• .tuf-on-ci/custom_failure.md

I think to start with, a shared message upon failure would be enough.

[jku]

New data to support this idea: I did not realize sigstore-probers alerts sigstore on-call if it's less than 15 days until expiry of root or targets (sigstore/sigstore-probers#207): this is a fine feature but preferably we should have had that information in the signing event message so I would have known to react and not bother on-call...

Would be great if we could also include the current expiry date in either the root-signing custom message or maybe preferably just the signing event default message.

[kommendorkapten]

Yes, having the expiry date in the messaging is a great idea!