# yad-managed: yad-checks
# verified-commits gate for the PRODUCT HUB: every PR (including the front-half review/EP-* PRs)
# must contain only commits whose signature the platform marks Verified AND whose author email is a
# known identity (.sdlc/verified-authors — generated by `yad check --fix` from the hub roster).
# Standalone workflow so it never collides with the hub-flavored yad-checks workflow.
name: yad-verified-commits
on:
  pull_request:
    branches: ["**"]

permissions:
  contents: read

jobs:
  verified-commits:
    runs-on: ubuntu-latest
    env:
      GH_TOKEN: ${{ github.token }} # read-only: gh api commits/<sha> for the Verified badge
    steps:
      - uses: actions/checkout@v4
        with: { fetch-depth: 0 }
      - run: bash checks/verified-commits.sh "origin/${{ github.base_ref }}"