Skip to content

Update policy-enforcement.yml #18

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
mr-adonis-jimenez wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update policy-enforcement.yml #18

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 32 additions & 6 deletions .github/workflows/policy-enforcement.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,32 +29,58 @@ jobs:
with:
fetch-depth: 0

# ─────────────────────────────────────────────
# Branch naming (PRs only — correct context)
# ─────────────────────────────────────────────
- name: Validate branch naming
if: github.event_name == 'pull_request'
run: |
BRANCH="${GITHUB_HEAD_REF:-${GITHUB_REF#refs/heads/}}"
BRANCH="${GITHUB_HEAD_REF}"
echo "Branch: $BRANCH"

if [[ ! "$BRANCH" =~ ^(main|release\/.+|feature\/.+|bugfix\/.+|hotfix\/.+)$ ]]; then
echo "❌ Invalid branch name"
echo "❌ Invalid branch name: $BRANCH"
exit 1
fi

# ─────────────────────────────────────────────
# Signed commit verification (safe ranges)
# ─────────────────────────────────────────────
- name: Verify signed commits
run: |
git log --format='%G?' origin/main..HEAD | grep -vq '^[GU]$' && {
if [ "${{ github.event_name }}" = "pull_request" ]; then
git fetch origin ${{ github.base_ref }}
RANGE="origin/${{ github.base_ref }}...HEAD"
else
RANGE="HEAD~1..HEAD"
Comment on lines +51 to +55

@chatgpt-codex-connector chatgpt-codex-connector Bot Jan 23, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Check every commit in a push, not only the last one

For push events, the verification range is set to HEAD~1..HEAD, which only inspects the most recent commit. If a push to main contains multiple commits and any earlier commit is unsigned or unverified, this job will still pass because those commits aren’t in the range. This weakens the policy enforcement for multi-commit pushes; consider using the push range (${{ github.event.before }}..${{ github.sha }}) or a similar range that includes all commits in the push.

Useful? React with 👍 / 👎.

fi

git log --format='%G?' $RANGE | grep -vq '^[GU]$' && {
echo "❌ Unsigned or unverified commits detected"
exit 1
} || echo "✅ All commits verified"

# ─────────────────────────────────────────────
# YAML linting (tool installed first)
# ─────────────────────────────────────────────
- name: Install yamllint
run: pip install yamllint

- name: Lint configuration files
run: |
yamllint .github || exit 1
run: yamllint .github

# ─────────────────────────────────────────────
# Dependency review (PRs only — REQUIRED)
# ─────────────────────────────────────────────
- name: Dependency vulnerability scan
if: github.event_name == 'pull_request'
uses: github/dependency-review-action@v4
with:
fail-on-severity: high

# ─────────────────────────────────────────────
# Summary
# ─────────────────────────────────────────────
- name: CI policy summary
run: |
echo "✅ Policy enforcement passed"
echo "### ✅ Policy enforcement passed" >> $GITHUB_STEP_SUMMARY