Abhishek6122008 opened a new pull request, #337: URL: https://github.com/apache/fineract-backoffice-ui/pull/337
Closes #336 Picking this one up — initial commit, happy to take feedback before I go further. Ports the signed-commit check from `apache/fineract` (`verify-commits.yml` + `scripts/verify-signed-commits.sh`) so contributor expectations match between the two repos. **What's here** - `.github/workflows/signed-commit.yml` — runs on `pull_request` (opened/synchronize/reopened), checks out with full history, verifies the PR commit range in `--strict` mode so unsigned commits fail the job. - `scripts/verify-signed-commits.sh` — walks `merge-base..head`, prints a per-commit signed/unsigned line, and emits `::error title=Unsigned Commit::` annotations so the offending commits are called out directly in the job log. **Notes** - Only `%G?` == `N` (no signature) fails. A runner has no contributor public keys, so `E`/`U` would flag every *signed* commit as broken — GitHub's own verification covers key validity. Same behaviour as the fineract script. - Default `--base-ref` is `origin/main` (fineract's is `origin/develop`). - Pinned `actions/checkout` to the same SHA already used by `zizmor.yml`, with `persist-credentials: false`. - The docs half of the acceptance criteria already exists — [CONTRIBUTING.md#commit-signing](https://github.com/apache/fineract-backoffice-ui/blob/main/CONTRIBUTING.md#commit-signing) covers `user.signingkey` / `commit.gpgsign` and retroactive signing, so the script points there instead of duplicating it. Say the word if you'd rather have a separate `docs/ci.md`. Verified locally against a range containing a known unsigned commit — it's correctly identified and `--strict` exits 1. cc @Aman-Mittal -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
