signer: Open PR in browser when using forks

* use webbrowser module to open PR in browser when fork is used
* Allow use of a specific PR template (e.g.
  ".github/PULL_REQUEST_TEMPLATE/signing_event.md")
* Tweak the commit and PR messages:
  * "Signature from <USER>"
  * "<USER> accepted invitation"
  * "<ROLE> role/delegation change"
  * "Initial root and targets"
* Remove "--progress" from push: This should remove most git output

signer/tuf_on_ci_sign/_common.py

@@ -6,6 +6,7 @@
 import logging
 import os
 import subprocess
+import webbrowser
 from collections.abc import Generator
 from contextlib import contextmanager
 from datetime import datetime, timedelta
@@ -157,19 +158,34 @@ def application_update_reminder() -> None:
         logger.warning(f"Failed to check current tuf-on-ci-sign version: {e}")
 
 
-def push_changes(user: User, event_name: str) -> None:
+def push_changes(user: User, event_name: str, title: str) -> None:
     """Push the event branch to users push remote"""
     branch = f"{user.push_remote}/{event_name}"
     msg = f"Press enter to push changes to {branch}"
     click.prompt(bold(msg), default=True, show_default=False)
     git_echo(
         [
             "push",
-            "--progress",
             user.push_remote,
             f"HEAD:refs/heads/{event_name}",
         ]
     )
+    if user.push_remote != user.push_remote:
+        # Create PR from fork (push remote) to upstream (pull remote)
+        upstream = get_repo_name({user.pull_remote})
+        fork = get_repo_name({user.push_remote}).replace("/", ":")
+        query = parse.urlencode(
+            {
+                "quick_pull": 1,
+                "title": title,
+                "template": "signing_event.md",
+            }
+        )
+        pr_url = f"https://github.com/{upstream}/compare/{event_name}...{fork}:{event_name}?{query}"
+        if webbrowser.open(pr_url):
+            click.echo(bold("Please open the pull request in your browser"))
+        else:
+            click.echo(bold(f"Please open the pull request:\n    {pr_url}"))
 
 
 def get_repo_name(remote: str) -> str:

signer/tuf_on_ci_sign/delegate.py

@@ -382,7 +382,7 @@ def delegate(verbose: int, push: bool, event_name: str, role: str | None):
                 )
 
             if push:
-                push_changes(user_config, event_name)
+                push_changes(user_config, event_name, msg)
             else:
                 # TODO: deal with existing branch?
                 click.echo(f"Creating local branch {event_name}")

signer/tuf_on_ci_sign/sign.py

@@ -38,7 +38,7 @@ def sign(verbose: int, push: bool, event_name: str):
     with signing_event(event_name, user_config) as repo:
         if repo.state == SignerState.UNINITIALIZED:
             click.echo("No metadata repository found")
-            changed = False
+            change_status = None
         elif repo.state == SignerState.INVITED:
             click.echo(
                 f"You have been invited to become a signer for role(s) {repo.invites}."
@@ -56,23 +56,23 @@ def sign(verbose: int, push: bool, event_name: str):
                 for rolename in repo.unsigned:
                     click.echo(repo.status(rolename))
                     repo.sign(rolename)
-            changed = True
+            change_status = f"{user_config.name} accepted invitation"
         elif repo.state == SignerState.SIGNATURE_NEEDED:
             click.echo(f"Your signature is requested for role(s) {repo.unsigned}.")
             for rolename in repo.unsigned:
                 click.echo(repo.status(rolename))
                 repo.sign(rolename)
-            changed = True
+            change_status = f"Signature from {user_config.name}"
         elif repo.state == SignerState.NO_ACTION:
-            changed = False
+            change_status = None
         else:
             raise NotImplementedError
 
-        if changed:
+        if change_status:
             git_expect(["add", "metadata"])
-            git_expect(["commit", "-m", f"Signed by {user_config.name}", "--signoff"])
+            git_expect(["commit", "-m", change_status, "--signoff"])
             if push:
-                push_changes(user_config, event_name)
+                push_changes(user_config, event_name, change_status)
             else:
                 # TODO: maybe deal with existing branch?
                 click.echo(f"Creating local branch {event_name}")