KRYSTALM7 opened a new pull request, #111:
URL: https://github.com/apache/fineract-loan-origination/pull/111
## Description
Adds a GitHub Actions workflow to verify that all commits in a pull request
are reported as **Verified** by GitHub.
The check provides contributors with an automatic pull request comment when
one or more commits are not verified, including the affected commits,
verification reason, and instructions for resolving the issue.
## Changes
### GitHub Actions workflow
- Added `.github/workflows/signed-commit.yml`.
- Runs when a pull request is opened, updated, or reopened.
- Uses the GitHub REST API to inspect the commits associated with the pull
request.
- Checks `commit.verification.verified` for each commit.
- Groups unverified commits by GitHub verification reason.
- Adds a single bot comment describing the verification failures and
remediation steps.
- Updates the existing comment when new commits are pushed.
- Removes the comment once all commits are verified.
- Fails the workflow when one or more commits are not verified.
- Uses least-privilege permissions:
- `contents: read`
- `pull-requests: write`
- Pins the GitHub Script action to a full commit SHA.
### Local verification helper
- Added `scripts/verify-signed-commits.sh` as a local convenience check.
- Checks commits between the merge base and the current branch.
- Uses Git's `%G?` status to detect commits without a signature.
- This script is not used as the CI enforcement mechanism.
- GitHub's verification result remains authoritative because local Git
signature validation cannot reproduce GitHub's account, key, and email
verification checks.
## Verification
The following checks were performed:
- Verified the pinned `actions/github-script` SHA matches `v7.0.1`.
- Validated the workflow YAML successfully.
- Validated the shell script with `bash -n`.
- Verified the workflow detects unverified commits and reports them through
the pull request comment.
## Notes
The workflow relies on GitHub's own commit verification result rather than
performing a local GPG verification on the runner.
A commit may contain a valid cryptographic signature and still be reported
as **Unverified** by GitHub when the signing key or committer identity cannot
be associated with a verified GitHub account. Checking
`commit.verification.verified` therefore matches the verification status shown
by GitHub to contributors and maintainers.
## JIRA
[FINERACT-2442](https://issues.apache.org/jira/browse/FINERACT-2442)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
