From 44e03e9381a6fc56e196144a7e63bf610bff1407 Mon Sep 17 00:00:00 2001 From: Erik Arvidsson Date: Tue, 14 Jul 2026 12:50:38 +0200 Subject: [PATCH] fix: bump verify-signed-commit-authors pin past allowed_signers fixes MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The action pin at 088d5c5d predates the allowed_signers updates that followed it — notably #33 (arv's corrected public key) and the newer team keys — so the required workflow verified signatures against a stale 4-entry allowlist and rejected validly signed commits (e.g. rocicorp/mono#6231). Pin to current main (2e203740) which bundles the up-to-date allowed_signers. Note: any future edit to allowed_signers needs a matching pin bump here to take effect. --- .github/workflows/signed-commit-authors.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/signed-commit-authors.yml b/.github/workflows/signed-commit-authors.yml index 151af8f..5cd141f 100644 --- a/.github/workflows/signed-commit-authors.yml +++ b/.github/workflows/signed-commit-authors.yml @@ -31,7 +31,7 @@ jobs: - name: Verify signed commit authors if: github.event_name == 'pull_request' - uses: rocicorp/.github/.github/actions/verify-signed-commit-authors@088d5c5d2e03a20c25cea0876a45fb1b1675e8c4 + uses: rocicorp/.github/.github/actions/verify-signed-commit-authors@2e203740c856d1aafcf8ea31c7923eb76e2288ed with: enforce: true github-token: ${{ github.token }}