feat: support Document Picture-in-Picture with native Wayland windows #5
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Pull Request Opened/Synchronized | |
| on: | |
| pull_request_target: # zizmor: ignore[dangerous-triggers] deliberate; only base-branch code runs, the PR head is never checked out (see SECURITY note) | |
| types: [opened, synchronize] | |
| # SECURITY: This workflow uses pull_request_target and has access to secrets. | |
| # Do NOT checkout or run code from the PR head. All code execution must use | |
| # the base branch only. Adding a ref to PR head would expose secrets to | |
| # untrusted code. | |
| permissions: {} | |
| jobs: | |
| check-signed-commits: | |
| name: Check signed commits in PR | |
| runs-on: ubuntu-slim | |
| permissions: | |
| contents: read | |
| pull-requests: write | |
| steps: | |
| - name: Check signed commits in PR | |
| uses: 1Password/check-signed-commits-action@ed2885f3ed2577a4f5d3c3fe895432a557d23d52 # v1 | |
| with: | |
| comment: | | |
| ⚠️ This PR contains unsigned commits. This repository enforces [commit signatures](https://docs.github.com/en/authentication/managing-commit-signature-verification) | |
| for all incoming PRs. To get your PR merged, please sign those commits | |
| (`git rebase --exec 'git commit -S --amend --no-edit -n' @{upstream}`) and force push them to this branch | |
| (`git push --force-with-lease`) | |
| For more information on signing commits, see GitHub's documentation on [Telling Git about your signing key](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key). | |
| - name: Add needs-signed-commits label | |
| if: ${{ failure() }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| run: | | |
| gh pr edit $PR_URL --add-label needs-signed-commits | |
| - name: Remove needs-signed-commits label | |
| if: ${{ success() && contains(github.event.pull_request.labels.*.name, 'needs-signed-commits') }} | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| PR_URL: ${{ github.event.pull_request.html_url }} | |
| run: | | |
| gh pr edit $PR_URL --remove-label needs-signed-commits |