🔧 infra: fix UniTask dependency format to use SemVer version #90
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| # yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json | |
| name: Commit Sentinel | |
| on: | |
| push: | |
| branches: | |
| - main | |
| pull_request: | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| checks: write | |
| statuses: write | |
| jobs: | |
| signature-and-style: | |
| name: Trust & Style Audit | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout full history | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Trust soo-bak signing key | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| mkdir -p ~/.ssh | |
| printf "%s\n" 'soo-bak@github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDwMav68GMpY0c5ZkVv859NppHgfzMfrCYyQuByZwNtq' > ~/.ssh/allowed_signers | |
| git config --global gpg.format ssh | |
| git config --global gpg.ssh.allowedSignersFile ~/.ssh/allowed_signers | |
| - name: Enforce signed commits | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| event="${{ github.event_name }}" | |
| head="${{ github.sha }}" | |
| commit_file="$GITHUB_WORKSPACE/.git/commit_range" | |
| commits="" | |
| ensure_commit() { | |
| git rev-parse --quiet --verify "${1}^{commit}" > /dev/null 2>&1 | |
| } | |
| if [ "$event" = "pull_request" ]; then | |
| base="${{ github.event.pull_request.base.sha }}" | |
| commits=$(git rev-list "$head" "^$base") | |
| elif [ "$event" = "push" ]; then | |
| before="${{ github.event.before }}" | |
| if [ -n "$before" ] && [ "$before" != "0000000000000000000000000000000000000000" ]; then | |
| if ! ensure_commit "$before"; then | |
| git fetch --quiet origin "$before" || true | |
| fi | |
| if ensure_commit "$before"; then | |
| commits=$(git rev-list "$head" "^$before") | |
| fi | |
| fi | |
| fi | |
| if [ -z "$commits" ]; then | |
| commits=$(git rev-list "$head" -n 1) | |
| echo "::notice::Commit range fallback to HEAD only." >&2 | |
| fi | |
| commits=$(echo "$commits" | sed '/^$/d') | |
| if [ -z "$commits" ]; then | |
| echo "::notice::No commits to verify." | |
| exit 0 | |
| fi | |
| printf "%s\n" "$commits" > "$commit_file" | |
| echo "COMMIT_LIST_FILE=$commit_file" >> "$GITHUB_ENV" | |
| declare -a unsigned=() | |
| declare -a invalid=() | |
| while read -r commit; do | |
| status=$(git log --format='%G?' -n 1 "$commit") | |
| subject=$(git log --format='%s' -n 1 "$commit") | |
| case "$status" in | |
| G|U|X|Y|E|R|D|L) | |
| echo "::notice::Commit $commit signed (status=$status): $subject" | |
| ;; | |
| B) | |
| echo "::error::Commit $commit has a bad signature (status=$status): $subject" >&2 | |
| invalid+=("$commit") | |
| ;; | |
| *) | |
| echo "::error::Commit $commit lacks a signature (status=$status): $subject" >&2 | |
| unsigned+=("$commit") | |
| ;; | |
| esac | |
| done < "$commit_file" | |
| if [ ${#invalid[@]} -gt 0 ] || [ ${#unsigned[@]} -gt 0 ]; then | |
| if [ ${#invalid[@]} -gt 0 ]; then | |
| printf "%s\n" "${invalid[@]}" > "$GITHUB_WORKSPACE/.git/invalid_commits" | |
| echo "::error::Invalid signature commits: $(printf '%s ' "${invalid[@]}")" >&2 | |
| fi | |
| if [ ${#unsigned[@]} -gt 0 ]; then | |
| printf "%s\n" "${unsigned[@]}" > "$GITHUB_WORKSPACE/.git/unsigned_commits" | |
| echo "::error::Unsigned commits: $(printf '%s ' "${unsigned[@]}")" >&2 | |
| fi | |
| exit 1 | |
| fi | |