From 5736a83ef3888417799375325ba1c42732a3ce0e Mon Sep 17 00:00:00 2001
From: Nick Schonning <nschonni@gmail.com>
Date: Fri, 7 Aug 2026 23:15:11 -0400
Subject: [PATCH 1/2] chore: add automation for release keys

---
 .github/workflows/automatic-release-keys.yml | 33 ++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 .github/workflows/automatic-release-keys.yml

diff --git a/.github/workflows/automatic-release-keys.yml b/.github/workflows/automatic-release-keys.yml
new file mode 100644
index 000000000..e8398b05b
--- /dev/null
+++ b/.github/workflows/automatic-release-keys.yml
@@ -0,0 +1,33 @@
+name: Automatically update Node.js team release keys
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '0 12 * * 1'
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'nodejs'
+    permissions:
+      pull-requests: write
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run automation script
+        run: ./update-keys.sh
+
+      - name: Create update PR
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
+        with:
+          token: ${{ secrets.GH_API_TOKEN }}
+          author: 'Node.js GitHub Bot <nodejs-github-bot@users.noreply.github.com>'
+          branch: keys-branch
+          base: main
+          commit-message: 'chore: Node.js release key sync'
+          title: 'chore: Node.js release key sync'
+          body: Open based on changes from `update-keys.sh`. For details on whose key is changing, look at https://github.com/nodejs/node#release-keys
+          delete-branch: true
+          team-reviewers: |
+            nodejs/docker

From c726a9923de749008a872ea50c67084bd99116b5 Mon Sep 17 00:00:00 2001
From: Nick Schonning <nschonni@gmail.com>
Date: Tue, 11 Aug 2026 00:06:25 -0400
Subject: [PATCH 2/2] ci: Add check for node.keys

---
 .github/workflows/node-keys.yml | 24 ++++++++++++++++++++++++
 1 file changed, 24 insertions(+)
 create mode 100644 .github/workflows/node-keys.yml

diff --git a/.github/workflows/node-keys.yml b/.github/workflows/node-keys.yml
new file mode 100644
index 000000000..dd9dd84a8
--- /dev/null
+++ b/.github/workflows/node-keys.yml
@@ -0,0 +1,24 @@
+name: Node.js Release Key Check
+
+on:
+  pull_request:
+    paths:
+      - keys/node.keys
+      - .github/workflows/node-keys.yml
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'nodejs'
+
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Run automation script
+        run: ./update-keys.sh
+
+      - name: Ensure no git changes
+        run: git diff --exit-code