Aman-Mittal opened a new issue, #336:
URL: https://github.com/apache/fineract-backoffice-ui/issues/336
Create a GitHub Actions check that verifies commits are signed (GPG/SSH) for
incoming changes, matching the behavior used in the main Apache Fineract
repository.
Goals
- Prevent unsigned commits from being merged into the repository by
verifying signature presence and validity on commits in PRs and pushed branches.
- Mirror the signed-commit verification used in apache/fineract so
contributor expectations and repository security are consistent.
Acceptance criteria
- A new workflow (e.g., .github/workflows/signed-commit.yml) runs on
pull_request and push events and fails if any commit in the PR or push is not
properly signed or the signature cannot be verified.
- The workflow clearly reports which commits are unsigned or have invalid
signatures in the job logs.
- Documentation (CONTRIBUTING.md or a new docs/ci.md) is updated describing
the requirement and how contributors can sign commits locally.
Implementation notes / suggestions
- Add a GitHub Actions workflow triggered for pull_request and push that
checks each commit in the incoming change set for a valid signature.
- Use a well-maintained action that verifies commit signatures (there are
community actions which perform this check). If apache/fineract uses a specific
action/workflow, mirror the same approach and configuration.
- Example workflow behavior:
- Checkout the PR/branch commits
- For each commit, run a verification step that inspects git commit
signatures (gpg --verify or git verify-commit)
- Fail the job when any commit is unsigned or verification fails
- Add a short note in CONTRIBUTING.md explaining how to configure git
(user.signingkey, commit.gpgsign) and how to sign commits locally (git commit
-S)
Notes / references
- Implement the workflow consistent with the project's CI conventions and
the Apache Fineract main repository's signed-commit check.
Please implement this as a Task with CI/automation/security labels.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
