search

FantasticFiasco / action-update-license-year

GitHub Action that in a pull request updates the copyright year(s) in your license file.
Apache License 2.0
58 stars 2 forks source link

Signed Commits #217

Closed C0D3-M4513R closed 2 years ago

C0D3-M4513R commented 2 years ago

Is your feature request related to a problem? Please describe. I recently got a pull request in a repo of mine, to update the Year in the license as expected. My issue with that PR was with two things:

  1. My Linter Action for PRs just never completed?
  2. The Commit to the PR was unsigned. I require signed commits though.

Describe the solution you'd like Add a way, for this github-action to make signed commits.

Describe alternatives you've considered Not requiring commit signing? idk?

https://github.com/FantasticFiasco/action-update-license-year/issues/119#issuecomment-757544256 :

because it would most probably require you to save your private key in GitHub

As a file, or in a config publicly (since workflows cannot use secrets)? - If yes, than this should NEVER be realeased as a feature. Public repos should NEVER have private gpg keys publicly accessible and private repos shouldn't have a need for Licences and signed commits.

github-actions[bot] commented 2 years ago

Hi there and welcome to this repository!

A maintainer will be with you shortly, but first and foremost I would like to thank you for taking the time to report this issue. Quality is of the highest priority for us, and we would never release anything with known defects. We aim to do our best but unfortunately you are here because you encountered something we didn't expect. Lets see if we can figure out what went wrong and provide a remedy for it.

FantasticFiasco commented 2 years ago

Hi @C0D3-M4513R and welcome to the repo!

Regarding the linter, I looked at your repo and especially the linter workflow, and found that this action isn't used in that workflow, thus I don't think they have anything in common. The problem with the linter is probably unrelated with this action.

Regarding signed commits, I will start to investigate it. To ease your mind, it would of course not involve publicly accessible secrets, but instead rely on GitHub Secrets, configured on the repo or organization. These secrets are available on branches and pull requests opened from the same repo, but will not be available on pull requests opened from forks.

FantasticFiasco commented 2 years ago

A heads up regarding the progress. The implementation is done, tests and documentation remains.

FantasticFiasco commented 2 years ago

The feature has now been released and you've been added to the list of contributors in README.md.

Thanks for the feature request!

C0D3-M4513R commented 2 years ago

I saw, that I've been added. Thank you, for making this action.