From 310437164ff577dcdaa925344df2ccead76998c2 Mon Sep 17 00:00:00 2001
From: Ziya Suzen <ziya@suzen.net>
Date: Sun, 25 May 2025 19:57:41 +0100
Subject: [PATCH 1/4] Add signature checks to CI workflow

This introduces a new workflow ensuring all commits are GPG signed.
---
 .github/workflows/signoffs.yml | 24 ++++++++++++++++++++++++
 NATS.Net.sln                   |  1 +
 2 files changed, 25 insertions(+)
 create mode 100644 .github/workflows/signoffs.yml

diff --git a/.github/workflows/signoffs.yml b/.github/workflows/signoffs.yml
new file mode 100644
index 000000000..257e03b4f
--- /dev/null
+++ b/.github/workflows/signoffs.yml
@@ -0,0 +1,24 @@
+name: Sign-offs
+
+on:
+  pull_request: {}
+
+jobs:
+
+  signoffs:
+    runs-on: ubuntu-latest
+    steps:
+      - { name: Checkout, uses: actions/checkout@v4, with: { fetch-depth: 0 } }
+      - name: Check commit signatures
+        if: github.event_name == 'pull_request'
+        run: |
+          for commit in $(git rev-list origin/${{ github.base_ref }}..${{ github.event.pull_request.head.sha }}); do
+            if ! git verify-commit --raw $commit 2>&1 | grep -q SIG; then
+              echo "--------------------------------------------------------------"
+              echo "Error: Commit $commit is not signed using GPG, SSH, or S/MIME"
+              echo "https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
+              echo "--------------------------------------------------------------"
+              git log -1 --pretty=format:"%h %s" $commit
+              exit 1
+            fi
+          done
diff --git a/NATS.Net.sln b/NATS.Net.sln
index 81a6ce6a1..e983b72be 100644
--- a/NATS.Net.sln
+++ b/NATS.Net.sln
@@ -99,6 +99,7 @@ Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "workflows", "workflows", "{
 		.github\workflows\test_linux.yml = .github\workflows\test_linux.yml
 		.github\workflows\test_windows.yml = .github\workflows\test_windows.yml
 		.github\workflows\test_linux_core.yml = .github\workflows\test_linux_core.yml
+		.github\workflows\signoffs.yml = .github\workflows\signoffs.yml
 	EndProjectSection
 EndProject
 Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "examples", "examples", "{5BF3C0C5-94CA-4008-8DF5-890ED8E06990}"

From ae90cbabc7ee2da00637e215867ab2a1deca3edc Mon Sep 17 00:00:00 2001
From: mtmk <ziya@synadia.com>
Date: Tue, 27 May 2025 16:04:34 +0100
Subject: [PATCH 2/4] Potential fix for code scanning alert no. 13: Workflow
 does not contain permissions

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/workflows/signoffs.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/signoffs.yml b/.github/workflows/signoffs.yml
index 257e03b4f..cc499c3dd 100644
--- a/.github/workflows/signoffs.yml
+++ b/.github/workflows/signoffs.yml
@@ -3,6 +3,9 @@
 on:
   pull_request: {}
 
+permissions:
+  contents: read
+
 jobs:
 
   signoffs:

From 286bc0d7066acc8c09d0c03b2ef4e2a2641fd775 Mon Sep 17 00:00:00 2001
From: Ziya Suzen <ziya@suzen.net>
Date: Tue, 27 May 2025 16:19:53 +0100
Subject: [PATCH 3/4] Remove BOM

---
 .github/workflows/signoffs.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/signoffs.yml b/.github/workflows/signoffs.yml
index cc499c3dd..7baa5ee76 100644
--- a/.github/workflows/signoffs.yml
+++ b/.github/workflows/signoffs.yml
@@ -1,4 +1,4 @@
-name: Sign-offs
+name: Sign-offs
 
 on:
   pull_request: {}

From d642c8000917b7df74fbf699effc5011a7ec0a41 Mon Sep 17 00:00:00 2001
From: mtmk <ziya@synadia.com>
Date: Tue, 27 May 2025 16:21:18 +0100
Subject: [PATCH 4/4] Update .github/workflows/signoffs.yml

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
---
 .github/workflows/signoffs.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/signoffs.yml b/.github/workflows/signoffs.yml
index 7baa5ee76..6e0d14ea4 100644
--- a/.github/workflows/signoffs.yml
+++ b/.github/workflows/signoffs.yml
@@ -15,7 +15,7 @@ jobs:
       - name: Check commit signatures
         if: github.event_name == 'pull_request'
         run: |
-          for commit in $(git rev-list origin/${{ github.base_ref }}..${{ github.event.pull_request.head.sha }}); do
+          for commit in $(git rev-list "origin/${{ github.base_ref }}".."${{ github.event.pull_request.head.sha }}"); do
             if ! git verify-commit --raw $commit 2>&1 | grep -q SIG; then
               echo "--------------------------------------------------------------"
               echo "Error: Commit $commit is not signed using GPG, SSH, or S/MIME"