From 723ed5ac9bd5776ad6f248f173237a1c7ab07634 Mon Sep 17 00:00:00 2001
From: Chirag Rao <crao@redhat.com>
Date: Thu, 2 Jul 2026 17:41:05 +0530
Subject: [PATCH] Added commit signature verification with verified commit

---
 .github/workflows/commit-verification.yml | 36 +++++++++++++++++++++++
 .github/workflows/go.yml                  |  3 ++
 .github/workflows/integration-tests.yml   |  3 ++
 .github/workflows/lint.yml                |  3 ++
 .github/workflows/rust.yml                |  6 ++++
 5 files changed, 51 insertions(+)
 create mode 100644 .github/workflows/commit-verification.yml

diff --git a/.github/workflows/commit-verification.yml b/.github/workflows/commit-verification.yml
new file mode 100644
index 00000000..3ba417a6
--- /dev/null
+++ b/.github/workflows/commit-verification.yml
@@ -0,0 +1,36 @@
+# SPDX-FileCopyrightText: Chirag Rao <crao@redhat.com>
+#
+# SPDX-License-Identifier: CC0-1.0
+
+name: "Commit Verification"
+on:
+  pull_request:
+    branches:
+      - "main"
+  workflow_call:
+permissions:
+  contents: "read"
+
+jobs:
+  verify-commits:
+    name: "Verify commit signatures and authorship"
+    runs-on: " ubuntu-slim"
+    steps:
+      - name: "Verify all PR commits are signed and authored by PR owner"
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
+        run: |
+          set -euo pipefail
+          errors=$(gh api "repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits" \
+             -q '
+              .[] | .sha[:12] as $s |
+              (if .commit.verification.verified != true
+               then "::error::Commit \($s) is not signed and/or not verified (\(.commit.verification.reason))"
+               else empty end)
+            ')
+          if [ -n "${errors}" ]; then
+            echo "${errors}"
+            exit 1
+          fi
+          echo "All commits are signed and verified."
diff --git a/.github/workflows/go.yml b/.github/workflows/go.yml
index 672bee07..629caf9d 100644
--- a/.github/workflows/go.yml
+++ b/.github/workflows/go.yml
@@ -16,7 +16,10 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
+  verify-commits:
+    uses: ./.github/workflows/commit-verification.yml
   build:
+    needs: verify-commits
     name: "Build"
     runs-on: "ubuntu-24.04"
     steps:
diff --git a/.github/workflows/integration-tests.yml b/.github/workflows/integration-tests.yml
index f415dabc..16441714 100644
--- a/.github/workflows/integration-tests.yml
+++ b/.github/workflows/integration-tests.yml
@@ -24,7 +24,10 @@ env:
   REGISTRY: localhost:5000/trusted-execution-clusters
 
 jobs:
+  verify-commits:
+    uses: ./.github/workflows/commit-verification.yml
   integration-tests:
+    needs: verify-commits
     name: "KubeVirt integration tests"
     if: >-
       github.event.pull_request.author_association == 'MEMBER' ||
diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 9ff2a2f9..e175919d 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -25,7 +25,10 @@ env:
   ACTIONS_LINTS_TOOLCHAIN: 1.88.0
 
 jobs:
+  verify-commits:
+    uses: ./.github/workflows/commit-verification.yml
   linting:
+    needs: verify-commits
     name: "Lints, pinned toolchain"
     runs-on: "ubuntu-24.04"
     container: "ghcr.io/trusted-execution-clusters/buildroot:fedora"
diff --git a/.github/workflows/rust.yml b/.github/workflows/rust.yml
index 61f1e811..30a0c90c 100644
--- a/.github/workflows/rust.yml
+++ b/.github/workflows/rust.yml
@@ -23,7 +23,10 @@ env:
   CARGO_TERM_COLOR: always
 
 jobs:
+  verify-commits:
+    uses: ./.github/workflows/commit-verification.yml
   tests-stable:
+    needs: verify-commits
     name: "Tests, stable toolchain"
     runs-on: "ubuntu-24.04"
     container: "ghcr.io/trusted-execution-clusters/buildroot:fedora"
@@ -48,6 +51,7 @@ jobs:
       - name: "cargo test"
         run: cargo test --bins --lib
   tests-release-stable:
+    needs: verify-commits
     name: "Tests (release), stable toolchain"
     runs-on: "ubuntu-24.04"
     container: "ghcr.io/trusted-execution-clusters/buildroot:fedora"
@@ -72,6 +76,7 @@ jobs:
       - name: "cargo test (release)"
         run: cargo test --bins --lib --release
   tests-release-msrv:
+    needs: verify-commits
     name: "Tests (release), minimum supported toolchain"
     runs-on: "ubuntu-24.04"
     container: "ghcr.io/trusted-execution-clusters/buildroot:fedora"
@@ -102,6 +107,7 @@ jobs:
       - name: "cargo test (release)"
         run: cargo test --bins --lib --release
   tests-other-channels:
+    needs: verify-commits
     name: "Tests, unstable toolchain"
     runs-on: "ubuntu-24.04"
     container: "ghcr.io/trusted-execution-clusters/buildroot:fedora"