name: Pull Request Opened/Synchronized

on:
  pull_request_target:
    types: [opened, synchronize]

# SECURITY: This workflow uses pull_request_target and has access to secrets.
# Do NOT checkout or run code from the PR head. All code execution must use
# the base branch only. Adding a ref to PR head would expose secrets to
# untrusted code.
permissions: {}

jobs:
  check-signed-commits:
    name: Check signed commits in PR
    if: ${{ !contains(github.event.pull_request.labels.*.name, 'needs-signed-commits')}}
    runs-on: ubuntu-slim
    permissions:
      contents: read
      pull-requests: write
    steps:
      - name: Check signed commits in PR
        uses: 1Password/check-signed-commits-action@ed2885f3ed2577a4f5d3c3fe895432a557d23d52 # v1
        with:
          comment: |
            ⚠️ This PR contains unsigned commits. This repository enforces [commit signatures](https://docs.github.com/en/authentication/managing-commit-signature-verification) 
            for all incoming PRs. To get your PR merged, please sign those commits 
            (`git rebase --exec 'git commit -S --amend --no-edit -n' @{upstream}`) and force push them to this branch 
            (`git push --force-with-lease`)

            For more information on signing commits, see GitHub's documentation on [Telling Git about your signing key](https://docs.github.com/en/authentication/managing-commit-signature-verification/telling-git-about-your-signing-key).

      - name: Add needs-signed-commits label
        if: ${{ failure() }}
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
          PR_URL: ${{ github.event.pull_request.html_url }}
        run: |
          gh pr edit $PR_URL --add-label needs-signed-commits
