ci: Check for signed commits in PR

[bthomee]

High Level Overview of Change

This change adds a CI workflow that checks if all commits are signed.

Context of Change

When commits in a PR are unsigned, we currently only notice it right at the time when we want to merge the PR. This change will immediately notify the author when an unsigned commit has been added, and will provide instructions for how to amend and sign the commit.

Note that the pull_request_target event runs in the context of the default branch of the base repository, rather than in the context of the merge commit, as the pull_request event does. This prevents execution of unsafe code from the head of the pull request that could alter the repository or steal any secrets used in the workflow. This also means that this workflow will not run yet as part of this PR, but only going forward once it has been merged.

[legleux]

There also used to be a check that the terminal commit of releases was from a specific list of developers so not just that it was signed but who signed it.

[bthomee]

There also used to be a check that the terminal commit of releases was from a specific list of developers so not just that it was signed but who signed it.

Do you happen to recall where that check was and why it was removed?

[mathbunnyru]

When commits in a PR are unsigned, we currently only notice it right at the time when we want to merge the PR.

Not exactly, GitHub writes:

Merging is blocked
Commits must have verified signatures

Example: #6579

But it's difficult to notice, I agree.

Let's implement this workflow in actions, because it might be reused.
Also, it will give us the ability to see how it works before making changes in rippled.

[github-actions]

⚠️ This PR contains unsigned commits. To get your PR merged, please sign them. ⚠️

If only the most recent commit is unsigned, you can run:

1. Amend the commit: git commit --amend --no-edit -n -S
2. Overwrite the commit: git push --force-with-lease

If multiple commits are unsigned, you can run:

1. Go into interactive rebase mode: git rebase --interactive HEAD~<NUM_OF_COMMITS>,
   where NUM_OF_COMMITS is the number of most recent commits that will be available
   to edit.
2. Change "pick" to "edit" for the commits you need to sign, and then save and exit.
3. For each commit, run: git commit --amend --no-edit -n -S
4. Continue the rebase: git rebase --continue
5. Overwrite the commit(s): git push --force-with-lease

If you're new to commit signing, there are different ways to set it up:

Sign commits with gpg

Follow the steps below to set up commit signing with gpg:

1. Generate a GPG key
2. Add the GPG key to your GitHub account
3. Configure git to use your GPG key for commit signing

Sign commits with ssh-agent

Follow the steps below to set up commit signing with ssh-agent:

1. Generate an SSH key and add it to ssh-agent
2. Add the SSH key to your GitHub account
3. Configure git to use your SSH key for commit signing

Sign commits with 1Password

You can also sign commits using 1Password, which lets you sign commits with biometrics without the signing key leaving the local 1Password process.
See use 1Password to sign your commits.

[mathbunnyru]

Sign the commits and it will be good to go 🙂