name: Signed Commits

on: [push, pull_request]

permissions: {}
env:
    CARGO_TERM_COLOR: always

jobs:
    commit-signatures:
        name: Assert all commits are PGP-signed
        runs-on: ubuntu-latest
        if: github.event_name == 'push' || github.event.pull_request.head.repo.full_name != github.repository

        steps:
            - name: Checkout code
              uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
              with:
                  persist-credentials: false
                  fetch-depth: 0

            - name: Setup just
              uses: extractions/setup-just@f8a3cce218d9f83db3a2ecd90e41ac3de6cdfd9b # v3

            - name: Check commit signatures
              run: bash contrib/check-signatures.sh
