feat(ci): trigger commit verification in merge queues 🚦

.github/workflows/verify.yml

@@ -2,6 +2,7 @@ name: verify commit signatures 🕵🏻‍♂️
 
 on:
   pull_request:
+  merge_group:
 
 permissions: {}
 
@@ -25,5 +26,5 @@ jobs:
         env:
           GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
           GITHUB_REPOSITORY: ${{ github.repository }}
-          PR: ${{ github.event.pull_request.number }}
-        run: ./verify_commits.sh "$PR"
+          TARGET: ${{ github.event.pull_request.number || github.event.merge_group.head_ref }}
+        run: ./verify_commits.sh "$TARGET"

README.md

@@ -1,5 +1,6 @@
 # commit-verifier
 
 Verifies that pull request commits are SSH-signed with enrolled,
-hardware-backed (`sk-`, FIDO2) keys. Runs on pull requests as an organization
-required workflow; the enrollment registry is [`allowed_signers`](allowed_signers).
+hardware-backed (`sk-`, FIDO2) keys. Runs on pull requests and in merge queues as
+an organization required workflow; the enrollment registry is
+[`allowed_signers`](allowed_signers).

verify_commits.sh

@@ -1,11 +1,26 @@
 #!/usr/bin/env bash
 # See README.md for what this checks, how it works, and its limits.
-# Usage: GH_TOKEN=... GITHUB_REPOSITORY=owner/repo verify_commits.sh <pr-number>
+# Usage: GH_TOKEN=... GITHUB_REPOSITORY=owner/repo verify_commits.sh <pr-number|merge-queue-ref>
 set -euo pipefail
 
 : "${GH_TOKEN:?GH_TOKEN required}"
 : "${GITHUB_REPOSITORY:?GITHUB_REPOSITORY required}"
-PR_NUMBER="${1:?usage: $0 <pr-number>}"
+TARGET="${1:?usage: $0 <pr-number|merge-queue-ref>}"
+
+case "$TARGET" in
+  */gh-readonly-queue/*)
+    PR_NUMBER="${TARGET##*/pr-}"
+    PR_NUMBER="${PR_NUMBER%%-*}"
+    ;;
+  *)
+    PR_NUMBER="$TARGET"
+    ;;
+esac
+
+if [[ ! "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
+  echo "::error::could not resolve a pull request number from '$TARGET'"
+  exit 1
+fi
 
 WORKDIR="$(mktemp -d)"
 trap 'rm -rf "$WORKDIR"' EXIT