# yad-managed: yad-checks
# verified-commits gate for the PRODUCT: every PR (including the Shape review/EP-* PRs)
# must contain only commits whose signature the platform marks Verified. Who may author them is who has
# write access to the repo — yadflow keeps no author list.
# Standalone workflow so it never collides with the Product-flavored yad-checks workflow.
name: yad-verified-commits
on:
  pull_request:
    branches: ["**"]

permissions:
  contents: read

jobs:
  verified-commits:
    runs-on: ubuntu-latest
    env:
      GH_TOKEN: ${{ github.token }} # read-only: gh api commits/<sha> for the Verified badge
    steps:
      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
        with: { fetch-depth: 0 }
      - run: bash checks/verified-commits.sh "origin/${{ github.base_ref }}"