Browse Source
ci: reject tags if not signed by Matthew Holt's key (#3932)
* ci: reject tags if not signed by Matthew Holt's key
* ci: don't reject tags if an intermediate commits are not signed
master
Mohammed Al Sahaf
4 years ago
committed by
GitHub
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with
10 additions and
0 deletions
-
.github/workflows/release.yml
|
@ -53,6 +53,16 @@ jobs: |
|
|
echo "::set-output name=tag_patch::${TAG_PATCH}" |
|
|
echo "::set-output name=tag_patch::${TAG_PATCH}" |
|
|
echo "::set-output name=tag_special::${TAG_SPECIAL}" |
|
|
echo "::set-output name=tag_special::${TAG_SPECIAL}" |
|
|
|
|
|
|
|
|
|
|
|
- name: Validate commits and tag signatures |
|
|
|
|
|
run: | |
|
|
|
|
|
|
|
|
|
|
|
# Import Matt Holt's key |
|
|
|
|
|
curl 'https://github.com/mholt.gpg' | gpg --import |
|
|
|
|
|
|
|
|
|
|
|
echo "Verifying the tag: ${{ steps.vars.outputs.version_tag }}" |
|
|
|
|
|
# tags are only accepted if signed by Matt's key |
|
|
|
|
|
git verify-tag "${{ steps.vars.outputs.version_tag }}" || exit 1 |
|
|
|
|
|
|
|
|
- name: Cache the build cache |
|
|
- name: Cache the build cache |
|
|
uses: actions/cache@v2 |
|
|
uses: actions/cache@v2 |
|
|
with: |
|
|
with: |
|
|