Skip to content

ci: add commit verification workflow and update job dependencies #2992

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Coelho-Gustavo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

ci: add commit verification workflow and update job dependencies #2992

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 14 additions & 4 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,44 +29,54 @@ concurrency:
permissions: {}

jobs:
commit-verification:
permissions:
contents: read
uses: ./.github/workflows/commit-verification.yaml
Comment on lines +32 to +35

@devin-ai-integration devin-ai-integration Bot Oct 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔍 Standalone runs remain outside the gate

workflow_dispatch runs of golang-checks, config-checks, and e2e-tests bypass this dependency graph. Clarify whether “blocks everything else” applies only to CI-triggered runs.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.


variables:
needs: [commit-verification]
permissions:
contents: read
uses: ./.github/workflows/variables.yaml

code-scanning:
needs: [commit-verification]
permissions:
contents: read
security-events: write
packages: read
uses: ./.github/workflows/code-scanning.yaml

config-checks:
needs: [commit-verification]
permissions:
contents: read
uses: ./.github/workflows/config-checks.yaml

golang-checks:
needs: [commit-verification]
permissions:
contents: read
id-token: write
uses: ./.github/workflows/golang-checks.yaml

third-party-notices:
needs: [commit-verification]
permissions:
contents: read
id-token: write
uses: ./.github/workflows/third-party-notices-check.yaml

coverage:
needs: [golang-checks]
needs: [commit-verification, golang-checks]
permissions:
contents: read
id-token: write
uses: ./.github/workflows/coverage.yaml

image-builds:
needs: [variables, config-checks, golang-checks]
needs: [commit-verification, variables, config-checks, golang-checks]
permissions:
contents: read
id-token: write
Expand All @@ -79,7 +89,7 @@ jobs:
operator_image_base: ${{ needs.variables.outputs.operator_image_base }}

e2e-tests:
needs: [variables, image-builds]
needs: [commit-verification, variables, image-builds]
permissions:
contents: read
id-token: write
Expand All @@ -95,7 +105,7 @@ jobs:

release:
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
needs: [variables, e2e-tests]
needs: [commit-verification, variables, e2e-tests]
permissions:
contents: read
packages: write
Expand Down
55 changes: 55 additions & 0 deletions .github/workflows/commit-verification.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
# Copyright NVIDIA CORPORATION
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

name: Commit Verification

on:
workflow_call: {}

permissions:
contents: read

jobs:
commit-verification:
runs-on: ubuntu-latest
timeout-minutes: 5
steps:
- name: Verify triggering commit signature
env:
GH_TOKEN: ${{ github.token }}
COMMIT_SHA: ${{ github.sha }}

@devin-ai-integration devin-ai-integration Bot Oct 1, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟥 Unsigned earlier commits pass verification

When a push contains an unsigned commit followed by a verified one, COMMIT_SHA checks only the final commit. The pipeline then builds and publishes code from the unsigned commit.

Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

REPOSITORY: ${{ github.repository }}
run: |
echo "Checking signature verification for commit ${COMMIT_SHA}..."

if ! VERIFICATION_JSON="$(gh api "repos/${REPOSITORY}/commits/${COMMIT_SHA}" --jq '.commit.verification')"; then
echo "::error::Could not retrieve verification metadata for commit ${COMMIT_SHA}."
exit 1
fi

echo "Verification metadata: ${VERIFICATION_JSON}"

VERIFIED="$(echo "${VERIFICATION_JSON}" | jq -r '.verified')"
REASON="$(echo "${VERIFICATION_JSON}" | jq -r '.reason')"

echo "Commit SHA: ${COMMIT_SHA}"
echo "Verified: ${VERIFIED}"
echo "Reason: ${REASON}"

if [ "${VERIFIED}" != "true" ]; then
echo "::error::Commit ${COMMIT_SHA} is not verified (reason: ${REASON})."
exit 1
fi

echo "::notice::Commit ${COMMIT_SHA} signature verified (reason: ${REASON})."