action: stop teaching a 1-year identity-bundle TTL

[bordumb]

The setup guidance told users to export the CI bundle with --max-age-secs
31536000 (one year), so a key revoked after the bundle was minted would still
verify for up to a year. The guidance now recommends a 30-day window, bounding
the revocation-blindness window; a stale bundle already fails closed.

[github-actions]

Auths Commit Verification

Commit	Status	Details
69fc158a	❌ Failed	Commit carries no Auths-Id/Auths-Device trailer — it was not signed by auths sign (or predates KEL-native signing). Nothing to verify against.

Result: ❌ 0/1 commits verified

---

How to fix

Commit 69fc158a has no Auths signature (no Auths-Id/Auths-Device trailer).

1. Install auths

macOS: brew install auths
Linux: Download from releases

2. One-time setup (creates your identity and configures Git)

auths init

3. Sign this branch and push

auths sign origin/main..HEAD
git push --force-with-lease

For CI to verify the signer, commit an identity bundle:

auths id export-bundle --alias main --output .auths/ci-bundle.json --max-age-secs 2592000

Quickstart →