diff --git a/.github/workflows/doc-check-linter.yml b/.github/workflows/doc-check-linter.yml index 8693cfa..d4f475c 100644 --- a/.github/workflows/doc-check-linter.yml +++ b/.github/workflows/doc-check-linter.yml @@ -63,33 +63,48 @@ jobs: fi # ---------- Verify latest commit ---------- - - name: Verify latest commit signature + - name: Verify commit signature run: | if [ "${{ github.event_name }}" = "pull_request" ]; then - LATEST_COMMIT=${{ github.event.pull_request.head.sha }} - else - LATEST_COMMIT=$(git rev-parse HEAD) - fi + echo "🔍 PR mode: verifying ALL commits in PR" - echo "🔍 Verifying commit: $LATEST_COMMIT" + BASE=${{ github.event.pull_request.base.sha }} + HEAD=${{ github.event.pull_request.head.sha }} - if git verify-commit "$LATEST_COMMIT" >/dev/null 2>&1; then - echo "✅ Signature is cryptographically valid" - else - echo "❌ Invalid or missing GPG signature" - exit 1 - fi + # Get all commits in PR + COMMITS=$(git rev-list $BASE..$HEAD) + + for COMMIT in $COMMITS; do + echo "🔎 Checking commit: $COMMIT" + + # Step 1: Cryptographic verification + if git verify-commit "$COMMIT" >/dev/null 2>&1; then + echo "✅ Signature valid" + else + echo "❌ Commit not signed properly" + exit 1 + fi + + # Step 2: Fingerprint check + FINGERPRINT=$(git log -1 --pretty=format:'%GF' "$COMMIT") + echo "🔑 Fingerprint: $FINGERPRINT" - FINGERPRINT=$(git log -1 --pretty=format:'%GF' "$LATEST_COMMIT") - echo "🔑 Signing fingerprint: $FINGERPRINT" + TRUSTED_KEYS="83FB991D930D7177F25456C07F4C7CA953E1C09E D432152833DA3244" - TRUSTED_KEYS="83FB991D930D7177F25456C07F4C7CA953E1C09E D432152833DA3244 4AEE18F83AFDEB23 B5690EEEBB952194" + if echo "$TRUSTED_KEYS" | grep -q "$FINGERPRINT"; then + echo "✅ Trusted key" + else + echo "❌ Untrusted key!" + exit 1 + fi + done - if echo "$TRUSTED_KEYS" | grep -q "$FINGERPRINT"; then - echo "✅ Trusted signer" + echo "🎉 All PR commits are valid and trusted" + else - echo "❌ Untrusted signing key!" - exit 1 + echo "🔍 Push to main detected" + echo "â„šī¸ Skipping strict GPG verification for merge/rebase/squash commit" + git log -1 --oneline fi # ---------- Optional status for skipped forked PRs ----------