Skip to content

chore(ci): add signed commits check to integration #496

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
EliteCoder18 wants to merge 2 commits into
base: master
Choose a base branch
from
Open

chore(ci): add signed commits check to integration #496

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
eba7f04
chore(ci): add signed commits check to integration
EliteCoder18 Jun 4, 2026
83ca57f
chore: test unsigned commit detection
EliteCoder18 Jun 23, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/workflows/cont_integration.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,3 +161,18 @@ jobs:
cache: true
- name: Check docs
run: RUSTDOCFLAGS='-D warnings' cargo doc --workspace --all-features --no-deps

check-signed-commits:
name: Check signed commits
runs-on: ubuntu-latest
if: github.event_name == 'pull_request'
steps:
- name: Checkout
uses: actions/checkout@v6
with:
fetch-depth: 0
persist-credentials: false
- name: Verify all commits are GPG signed
run: ./ci/check-signed-commits.sh "${{ github.event.pull_request.base.sha }}" "${{ github.event.pull_request.head.sha }}"

@oleonardolima oleonardolima Jun 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

i'd rather have the bash call here instead of a new file, if it's only being used here, such as:

"$(git log --pretty='format:%G?' -1 HEAD)" = "N"  ] && \
       echo "\nERROR: unsigned commit: BDK requires that commits be signed." || \
       true

@oleonardolima oleonardolima Jun 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@EliteCoder18 you can see how i did here: oleonardolima@9748220

@oleonardolima oleonardolima Jun 18, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

if you'd rather keep the simpler version of the file, it could be used in the justfile check command too.

@EliteCoder18 EliteCoder18 Jun 19, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the suggestion! the justfile already uses a similar one-liner for local development, but intentionally with || true so it acts as a warning rather than blocking contributors mid-flow.

For CI, I feel the goal is stricter enforcement across the entire PR range (base_sha..head_sha), not just the latest commit. An inline HEAD check could miss cases where only the most recent commit is signed while earlier commits are not.

That said, I like the idea of reusing the same logic in the justfile as well, and I'm happy to wire the script into the local check recipe if you think that would be beneficial.

# test: verify unsigned commit detection

26 changes: 26 additions & 0 deletions ci/check-signed-commits.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,26 @@
#!/bin/bash

set -euo pipefail

BASE_SHA="${1:-}"
HEAD_SHA="${2:-}"

if [ -z "$BASE_SHA" ] || [ -z "$HEAD_SHA" ]; then
echo "Usage: $0 <base_sha> <head_sha>"
exit 1
fi

UNSIGNED=0
while IFS=' ' read -r commit status; do
if [ "$status" = "N" ]; then
echo "Commit $commit is not GPG signed."
UNSIGNED=$((UNSIGNED + 1))
fi
done < <(git log --format="%H %G?" "${BASE_SHA}..${HEAD_SHA}")

if [ "$UNSIGNED" -gt 0 ]; then
echo "Error: $UNSIGNED commit(s) are not GPG signed. See CONTRIBUTING.md."
exit 1
fi

echo "All commits are GPG signed."
Loading