feat(workflow): unified git/github workflow + contribution-as-evidence layer #10

	name: Signed commits

	on:
	pull_request:
	types: [opened, synchronize, reopened]
	branches: [main]

	permissions:
	contents: read

	jobs:
	verify:
	name: Every commit must be signed
	runs-on: ubuntu-latest
	# Bootstrap mode: report unsigned commits but don't block the merge until
	# all 4 active contributors have SSH signing configured. See CONTRIBUTING.md
	# for setup. Flip to false after the org-wide signing is set up.
	continue-on-error: true
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0
	- name: Check commits are signed
	env:
	BASE: ${{ github.event.pull_request.base.sha }}
	HEAD: ${{ github.event.pull_request.head.sha }}
	run: \|
	# %G? prints: G=good, B=bad, U=unknown trust, X=expired, Y=expired key, R=revoked, E=missing key, N=no signature
	UNSIGNED=$(git log --pretty=format:'%H %G?' "$BASE..$HEAD" \| awk '$2 != "G" {print $1}')
	if [ -n "$UNSIGNED" ]; then
	echo "::error::The following commits are not signed (or have invalid signatures):"
	for sha in $UNSIGNED; do
	SUBJECT=$(git log -1 --pretty=format:'%s' "$sha")
	STATUS=$(git log -1 --pretty=format:'%G?' "$sha")
	echo " $sha [$STATUS] $SUBJECT"
	done
	echo ""
	echo "Set up signing once:"
	echo " git config --global commit.gpgsign true"
	echo " git config --global gpg.format ssh"
	echo " git config --global user.signingkey ~/.ssh/id_ed25519.pub"
	echo "Then add the public key to GitHub: https://github.com/settings/ssh/new (type: signing key)"
	exit 1
	fi
	echo "All commits between $BASE and $HEAD are signed."

Navigation Menu