authenticate-commits.yml

name: Authenticate Commits
on:
  pull_request:
    types: [opened, reopened, synchronize]
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout repository
        uses: actions/checkout@v3
        with:
          fetch-depth: 0

      - name: Import allowed SSH keys
        env:
          ALLOWED_SIGNERS: ${{ vars.MIDDLEWARE_ALLOWED_SIGNERS }}
        run: |
          mkdir -p ~/.ssh
          echo "$ALLOWED_SIGNERS" > ~/.ssh/allowed_signers
          git config --global gpg.ssh.allowedSignersFile "~/.ssh/allowed_signers"

      - name: Validate commit signatures
        env:
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
        run: |
          # Function to verify a commit
          verify_commit() {
            local commit=$1
            local status=$(git show --pretty="format:%G?" $commit | head -n 1)

            if [ "$status" != "G" ]; then
              local committer=$(git log -1 --pretty=format:'%cn (%ce)' $commit)
              echo "Commit $commit from $committer has an invalid signature or is not signed by an allowed key."
              exit 1
            fi

          }

          # Get all commits in the PR
          commits=$(git rev-list $BASE_SHA..$HEAD_SHA)

          # Iterate over all commits in the PR and verify each one
          for COMMIT in $commits; do
            verify_commit $COMMIT
          done

          echo "All commits are signed with allowed keys."