check verification status of head commit when not known

src/create-pull-request.ts

@@ -181,7 +181,6 @@ export async function createPullRequest(inputs: Inputs): Promise<void> {
     const outputs = new Map<string, string>()
     outputs.set('pull-request-branch', inputs.branch)
     outputs.set('pull-request-operation', 'none')
-    outputs.set('pull-request-commits-verified', 'false')
 
     // Create or update the pull request branch
     core.startGroup('Create or update the pull request branch')
@@ -234,9 +233,6 @@ export async function createPullRequest(inputs: Inputs): Promise<void> {
       core.endGroup()
     }
 
-    // If the verified output is not set yet, and there are commits (from result), and the head commit is signed, then:
-    // Get the commit and check verification status
-
     if (result.hasDiffWithBase) {
       core.startGroup('Create or update the pull request')
       const pull = await ghPull.createOrUpdatePullRequest(
@@ -272,8 +268,31 @@ export async function createPullRequest(inputs: Inputs): Promise<void> {
       }
     }
 
-    // Set outputs
     core.startGroup('Setting outputs')
+    // If the head commit is signed, get its verification status if we don't already know it.
+    // This can happen if the branch wasn't updated (action = 'not-updated'), or GPG commit signing is in use.
+    if (
+      !outputs.has('pull-request-commits-verified') &&
+      result.branchCommits.length > 0 &&
+      result.branchCommits[result.branchCommits.length - 1].signed
+    ) {
+      core.info(`Checking verification status of head commit ${result.headSha}`)
+      try {
+        const headCommit = await ghBranch.getCommit(
+          result.headSha,
+          branchRepository
+        )
+        outputs.set(
+          'pull-request-commits-verified',
+          headCommit.verified.toString()
+        )
+      } catch (error) {
+        core.warning('Failed to check verification status of head commit.')
+        core.debug(utils.getErrorMessage(error))
+      }
+    }
+
+    // Set outputs
     for (const [key, value] of outputs) {
       core.info(`${key} = ${value}`)
       core.setOutput(key, value)

src/git-command-manager.ts

@@ -9,6 +9,7 @@ export type Commit = {
   sha: string
   tree: string
   parents: string[]
+  signed: boolean
   subject: string
   body: string
   changes: {
@@ -158,7 +159,7 @@ export class GitCommandManager {
       '--raw',
       '--cc',
       '--diff-filter=AMD',
-      `--format=%H%n%T%n%P%n%s%n%b%n${endOfBody}`,
+      `--format=%H%n%T%n%P%n%G?%n%s%n%b%n${endOfBody}`,
       ref
     ])
     const lines = output.stdout.split('\n')
@@ -169,8 +170,9 @@ export class GitCommandManager {
       sha: detailLines[0],
       tree: detailLines[1],
       parents: detailLines[2].split(' '),
-      subject: detailLines[3],
-      body: detailLines.slice(4, endOfBodyIndex).join('\n'),
+      signed: detailLines[3] !== 'N',
+      subject: detailLines[4],
+      body: detailLines.slice(5, endOfBodyIndex).join('\n'),
       changes: lines.slice(endOfBodyIndex + 2, -1).map(line => {
         const change = line.match(
           /^:(\d{6}) (\d{6}) \w{7} \w{7} ([AMD])\s+(.*)$/

src/github-helper.ts

@@ -295,6 +295,21 @@ export class GitHubHelper {
     }
   }
 
+  async getCommit(
+    sha: string,
+    branchRepository: string
+  ): Promise<CommitResponse> {
+    const repository = this.parseRepository(branchRepository)
+    const {data: remoteCommit} = await this.octokit.rest.git.getCommit({
+      ...repository,
+      commit_sha: sha
+    })
+    return {
+      sha: remoteCommit.sha,
+      verified: remoteCommit.verification.verified
+    }
+  }
+
   private async createOrUpdateRef(
     branchRepository: string,
     branch: string,