🚑 ci: fix workflow dependencies #4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json | ||
| name: Commit Sentinel | ||
| on: | ||
| push: | ||
| branches: | ||
| - main | ||
| pull_request: | ||
| workflow_dispatch: | ||
| permissions: | ||
| contents: read | ||
| checks: write | ||
| statuses: write | ||
| jobs: | ||
| signature-and-style: | ||
| name: Trust & Style Audit | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Checkout full history | ||
| uses: actions/checkout@v4 | ||
| with: | ||
| fetch-depth: 0 | ||
| - name: Trust soo-bak signing key | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| mkdir -p ~/.ssh | ||
| cat <<'EOF' > ~/.ssh/allowed_signers | ||
| soo-bak@github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDwMav68GMpY0c5ZkVv859NppHgfzMfrCYyQuByZwNtq | ||
| EOF | ||
| git config --global gpg.format ssh | ||
| git config --global gpg.ssh.allowedSignersFile ~/.ssh/allowed_signers | ||
| - name: Enforce signed commits | ||
| shell: bash | ||
| run: | | ||
| set -euo pipefail | ||
| if [ "${{ github.event_name }}" = "pull_request" ]; then | ||
| range="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" | ||
| elif [ -n "${{ github.event.before }}" ] && [ "${{ github.event.before }}" != "0000000000000000000000000000000000000000" ]; then | ||
| range="${{ github.event.before }}..${{ github.sha }}" | ||
| else | ||
| range="${{ github.sha }}" | ||
| fi | ||
| while read -r commit; do | ||
| if ! git verify-commit "$commit" >/dev/null 2>&1; then | ||
| echo "::error::Commit $commit lacks a trusted signature" >&2 | ||
| exit 1 | ||
| fi | ||
| done < <(git rev-list "$range") | ||
| - name: Lint commit titles | ||
| shell: pwsh | ||
| run: | | ||
| $eventName = '${{ github.event_name }}' | ||
| if ($eventName -eq 'pull_request') { | ||
| $range = '${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}' | ||
| } else { | ||
| $before = '${{ github.event.before }}' | ||
| $after = '${{ github.sha }}' | ||
| if ($before -and $before -ne '0000000000000000000000000000000000000000') { | ||
| $range = "$before..$after" | ||
| } else { | ||
| $range = $after | ||
| } | ||
| } | ||
| $pattern = '^:[a-z_]+: [a-z0-9-]+: .+' | ||
| $invalid = @() | ||
| git log --format='%h%x09%s' $range | ForEach-Object { | ||
| $parts = $_ -split "\t", 2 | ||
| if ($parts.Length -lt 2) { return } | ||
| $subject = $parts[1] | ||
| if ($subject -notmatch $pattern) { | ||
| $invalid += $subject | ||
| } | ||
| } | ||
| if ($invalid.Count -gt 0) { | ||
| Write-Error "Commit message(s) violate ':gitmoji: scope: message' convention:`n- " + ($invalid -join "`n- ") | ||
| } | ||
