Add advisory PR commit signature verification

[brooke-hamilton]

Summary

Add an advisory pull request workflow that checks every commit for a GitHub Verified cryptographic signature. A pinned actions/github-script step loads the trusted .github/scripts/verify-commit-signatures.mjs module, which paginates the commits, reports the result, and creates or updates a polite guidance comment that remains after all commits are verified. Maintainers can also run the workflow manually by providing a pull request number.

Reason for change

New contributors are asked to use cryptographically signed commits, so we want to give an early indication that it is required via a comment on the PR. Automating that reminder makes the cryptographic signing requirement visible after each push while keeping it separate from the existing DCO Signed-off-by requirement.

The workflow remains non-blocking for unsigned commits. API or workflow failures still fail the job so broken verification remains visible.

NOTE: When a user updates their commits to add signing and force pushes to the PR branch, the advisory message will not be deleted from the PR. This is by design so that PR authors can quote-reply the message to give status.

Example message

Thank you for contributing to Radius.

The following commits do not currently show a GitHub Verified signature:

• 19c7a59
• 2a80f28

Please follow our commit-signing guide to configure GPG, SSH, or S/MIME signing. Then re-sign the affected commits and force-push the rewritten branch with --force-with-lease.

Cryptographic commit signing is separate from the DCO Signed-off-by line; both are required.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

OpenSSF Scorecard

Package	Version	Score	Details
actions/actions/checkout	3d3c42e5aac5ba805825da76410c181273ba90b1	🟢 7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Maintained 🟢 10 24 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 10 Binary-Artifacts 🟢 10 no binaries found in the repo Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Pinned-Dependencies ⚠️ 3 dependency not pinned by hash detected -- score normalized to 3 Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches
actions/actions/github-script	3a2844b7e9c422d3c10d287c895573f7108da1b3	🟢 6.7	Details Check Score Reason Code-Review 🟢 10 all changesets reviewed Packaging ⚠️ -1 packaging workflow not detected Binary-Artifacts 🟢 10 no binaries found in the repo Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Token-Permissions 🟢 9 detected GitHub workflow tokens with excessive permissions Pinned-Dependencies ⚠️ 1 dependency not pinned by hash detected -- score normalized to 1 Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Security-Policy 🟢 9 security policy file detected SAST 🟢 10 SAST tool is run on all commits Branch-Protection 🟢 6 branch protection is not maximal on development and all release branches

Scanned Files

• .github/workflows/verify-commit-signatures.yml

[github-actions]

Unit Tests

    2 files  ±0    461 suites  ±0   9m 20s ⏱️ +41s
6 531 tests ±0  6 529 ✅ ±0  2 💤 ±0  0 ❌ ±0 
7 807 runs  ±0  7 805 ✅ ±0  2 💤 ±0  0 ❌ ±0 

Results for commit 8cb4e64. ± Comparison against base commit 468c715.

♻️ This comment has been updated with latest results.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.82%. Comparing base (468c715) to head (8cb4e64).

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #12703      +/-   ##
==========================================
- Coverage   59.82%   59.82%   -0.01%     
==========================================
  Files         779      779              
  Lines       46058    46058              
==========================================
- Hits        27555    27552       -3     
- Misses      18503    18506       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

Functional Tests - upgrade-noncloud

3 tests  ±0   3 ✅ ±0   3m 38s ⏱️ -46s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit fcbf3e3. ± Comparison against base commit 6882b5f.

♻️ This comment has been updated with latest results.

[Copilot]

Pull request overview

Adds advisory commit-signature verification for pull requests and documents cryptographic signing as a contributor requirement.

Changes:

• Adds signature detection and sticky PR guidance.
• Supports automatic and manual verification.
• Updates contributor signing documentation.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
.github/workflows/verify-commit-signatures.yml	Runs verification and posts guidance.
.github/scripts/verify-commit-signatures.sh	Finds unverified commits through GitHub GraphQL.
CONTRIBUTING.md	Adds the signing requirement.
docs/contributing/contributing-pull-requests/README.md	Documents signature-check behavior.
docs/contributing/contributing-code/contributing-code-first-commit/first-commit-06-creating-a-pr/index.md	Marks commit signing as required.

---

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

Functional Tests - corerp-cloud

32 tests  ±0   31 ✅ +2   20m 10s ⏱️ - 2m 48s
 2 suites ±0    1 💤 ±0 
 1 files   ±0    0 ❌  - 2 

Results for commit 6833783. ± Comparison against base commit 031840f.

♻️ This comment has been updated with latest results.

[github-actions]

Functional Tests - multicluster-noncloud

6 tests  ±0   6 ✅ ±0   2m 42s ⏱️ ±0s
1 suites ±0   0 💤 ±0 
1 files   ±0   0 ❌ ±0 

Results for commit 5b4bab3. ± Comparison against base commit fa29a3d.

♻️ This comment has been updated with latest results.

[radius-functional-tests]

Radius functional test overview

🔍 Go to test action run

Click here to see the test run details

Name	Value
Repository	radius-project/radius
Commit ref	8cb4e64
Unique ID	funcbf80ae48d1
Image tag	pr-funcbf80ae48d1

• Dapr: 1.14.4
• Azure KeyVault CSI driver: 1.4.2
• Azure Workload identity webhook: 1.3.0
• Bicep recipe location ghcr.io/radius-project/dev/test/testrecipes/test-bicep-recipes/<name>:pr-funcbf80ae48d1
• Terraform recipe location http://tf-module-server.radius-test-tf-module-server.svc.cluster.local/<name>.zip (in cluster)
• applications-rp test image location: ghcr.io/radius-project/dev/applications-rp:pr-funcbf80ae48d1
• dynamic-rp test image location: ghcr.io/radius-project/dev/dynamic-rp:pr-funcbf80ae48d1
• controller test image location: ghcr.io/radius-project/dev/controller:pr-funcbf80ae48d1
• ucp test image location: ghcr.io/radius-project/dev/ucpd:pr-funcbf80ae48d1
• deployment-engine test image location: ghcr.io/radius-project/deployment-engine:latest

Test Status

⌛ Building Radius and pushing container images for functional tests...
✅ Container images build succeeded
⌛ Publishing Bicep Recipes for functional tests...
✅ Recipe publishing succeeded
⌛ Starting corerp-cloud functional tests...
⌛ Starting ucp-cloud functional tests...
✅ ucp-cloud functional tests succeeded
✅ corerp-cloud functional tests succeeded