Import GPG Public Key block removed #169
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Portfolio CI | |
| on: | |
| push: | |
| branches: [main] | |
| pull_request: | |
| branches: [main] | |
| jobs: | |
| # ------------------- | |
| # 1. Lint HTML, CSS, JS | |
| # ------------------- | |
| lint: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout code | |
| uses: actions/checkout@v4 | |
| - name: Setup Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: 20 | |
| - name: Install linters | |
| run: npm install -g eslint stylelint htmlhint | |
| - name: Lint JavaScript | |
| run: eslint . --ext .js,.jsx || true | |
| - name: Lint CSS | |
| run: stylelint "**/*.{css,scss}" || true | |
| - name: Lint HTML | |
| run: htmlhint "**/*.html" || true | |
| # ------------------- | |
| # 2. DCO + GPG Check | |
| # 2.1 Commit Verification (GPG + Trust) | |
| # ------------------- | |
| commit-checks: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout repository | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 # full history, but we’ll check only the latest commit | |
| # ---------- DCO Check ---------- | |
| - name: DCO Check | |
| if: github.event_name == 'pull_request' | |
| uses: tisonkun/actions-dco@v1.1 | |
| - name: Import GPG public keys | |
| run: | | |
| if [ -n "${{ secrets.GPG_PUBLIC_KEY }}" ]; then | |
| echo "${{ secrets.GPG_PUBLIC_KEY }}" | gpg --import | |
| echo "✅ Imported GPG_PUBLIC_KEY" | |
| fi | |
| if [ -n "${{ secrets.GPG_PUBLIC_KEY_1 }}" ]; then | |
| echo "${{ secrets.GPG_PUBLIC_KEY_1 }}" | gpg --import | |
| echo "✅ Imported GPG_PUBLIC_KEY_1" | |
| fi | |
| # ---------- Verify latest commit ---------- | |
| - name: Verify latest commit signature | |
| run: | | |
| LATEST_COMMIT=${{ github.event.pull_request.head.sha }} | |
| echo "🔍 Verifying commit: $LATEST_COMMIT" | |
| if git verify-commit "$LATEST_COMMIT" >/dev/null 2>&1; then | |
| echo "✅ Signature is cryptographically valid" | |
| else | |
| echo "❌ Invalid or missing GPG signature" | |
| exit 1 | |
| fi | |
| FINGERPRINT=$(git log -1 --pretty=format:'%GF' "$LATEST_COMMIT") | |
| echo "🔑 Signing fingerprint: $FINGERPRINT" | |
| TRUSTED_KEYS="7F4C7CA953E1C09E D432152833DA3244 4AEE18F83AFDEB23 B5690EEEBB952194" | |
| if echo "$TRUSTED_KEYS" | grep -q "$FINGERPRINT"; then | |
| echo "✅ Trusted signer" | |
| else | |
| echo "❌ Untrusted signing key!" | |
| exit 1 | |
| fi | |
| # ---------- Optional status for skipped forked PRs ---------- | |
| - name: Skip GPG checks for external PRs | |
| if: ${{ github.event.pull_request.head.repo.full_name != github.repository && github.event_name == 'pull_request' }} | |
| run: echo "🟡 Skipping GPG verification for external PR (no access to secrets)." |