Test GitHub actions CI for labels and signed commits

.github/workflows/jenkins-dispatch.yml

@@ -3,10 +3,10 @@ name: Duranta Jenkins Dispatch
 on:
   pull_request_target:
     types: [opened, synchronize, reopened, labeled]
-    branches: [develop]
+    branches: [ci-duranta-fixes]
   push:
     branches:
-      - develop
+      - ci-duranta-fixes
 
 concurrency:
   group: ${{ github.event_name }}-${{ github.event.action }}-${{ github.event.pull_request.number || github.ref }}
@@ -17,12 +17,59 @@ permissions:
   pull-requests: write
 
 jobs:
+  verify-signed-commits:
+    runs-on: ubuntu-24.04
+
+    if: github.event_name == 'pull_request_target'
+
+    steps:
+      - name: Check all commits are signed
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          UNSIGNED=$(gh api repos/${{ github.repository }}/pulls/${{ github.event.pull_request.number }}/commits \
+            --paginate --jq '[.[] | select(.commit.verification.verified == false) | .sha[:7]] | join(", ")')
+
+          if [ -n "$UNSIGNED" ]; then
+            echo "::error::Unsigned commits found: $UNSIGNED"
+            exit 1
+          fi
+
+  check-labels:
+    needs: verify-signed-commits
+    runs-on: ubuntu-24.04
+
+    if: github.event_name == 'pull_request_target'
+
+    steps:
+      - name: Check for mandatory CI label
+        run: |
+          PR_LABELS=$(echo '${{ toJson(github.event.pull_request.labels) }}' | jq -r '.[].name')
+
+          for label in \
+            "BUILD-ONLY" \
+            "documentation" \
+            "5G-NR" \
+            "nrUE"; do
+            if echo "$PR_LABELS" | grep -qxF "$label"; then
+              exit 0
+            fi
+          done
+
+          exit 1
+
   detect-changes:
+    needs: check-labels
     runs-on: ubuntu-24.04
 
     if: |
-      github.event.action != 'labeled' ||
-      github.event.label.name == vars.RETRIGGER_CI_LABEL
+      always() && (
+        github.event_name == 'push' ||
+        needs.check-labels.result == 'success'
+      ) && (
+        github.event.action != 'labeled' ||
+        github.event.label.name == vars.RETRIGGER_CI_LABEL
+      )
 
     outputs:
       protected_files_changed: ${{ steps.filter.outputs.protected }}
@@ -53,14 +100,12 @@ jobs:
 
     runs-on: ubuntu-24.04
 
-    environment:
-      name: ci-approval
-
     steps:
-      - run: echo "Maintainer has approved the changes"
+      - run: echo "Changes to be approved"
 
   trigger-jenkins:
     needs:
+      - check-labels
       - detect-changes
       - require-maintainer-approval
 
@@ -93,17 +138,7 @@ jobs:
           if [ "$EVENT_NAME" = "pull_request_target" ]; then
             EVENT_NAME="pull_request"
           fi
-
-          curl -X POST "https://${{ secrets.J_USER }}:${{ secrets.J_PASS }}@${{ secrets.J_URL }}" \
-            -H "Accept: */*" \
-            -H "Content-Type: application/json" \
-            -H "User-Agent: GitHub-Hookshot/${{ secrets.H_AGENT }}" \
-            -H "X-Github-Delivery: ${{ secrets.GITHUB_TOKEN }}" \
-            -H "X-Github-Event: $EVENT_NAME" \
-            -H "X-Github-Hook-Id: ${{ secrets.H_ID }}" \
-            -H "X-Github-Hook-Installation-Target-Id: ${{ secrets.H_TARGET }}" \
-            -H "X-Github-Hook-Installation-Target-Type: repository" \
-            --data @/tmp/filtered_payload.json
+          echo '${{ toJson(github.event) }}'
 
       - name: Remove retrigger-ci label
         if: always() && github.event.action == 'labeled' && github.event.label.name == vars.RETRIGGER_CI_LABEL

README.md

@@ -1,5 +1,7 @@
+
 <!-- SPDX-License-Identifier: CC-BY-4.0 -->
 
+
 <h1 align="center">
     <a href="https://lfnetworking.org/projects/duranta/"><img src="https://raw.githubusercontent.com/duranta-project/governance/main/logos/Duranta-OAI-Combined.png" alt="Duranta OAI" width="550"></a>
 </h1>

ci-scripts/Jenkinsfile-GitHub-Container

@@ -96,18 +96,6 @@ pipeline {
         echo '\u2705 \u001B[32mVerify Labels\u001B[0m'
         script {
           if (env.GITHUB_PR_NUMBER) {
-            if (!(env.GITHUB_PR_LABELS)) {
-              def gitBaseUrl = env.GIT_URL.trim().replace('.git', '')
-              def message = "**CI Build:** [#${env.BUILD_NUMBER}](${BUILD_URL}) | Not performing CI due to the absence of one of the following mandatory labels:\n"
-              message += "- ${gitBaseUrl}/labels/documentation (don't perform any stages)\n"
-              message += "- ${gitBaseUrl}/labels/BUILD-ONLY (execute only build stages)\n"
-              message += "- ${gitBaseUrl}/labels/4G-LTE (perform 4G tests)\n"
-              message += "- ${gitBaseUrl}/labels/5G-NR (perform 5G tests)\n"
-              message += "- ${gitBaseUrl}/labels/nrUE (perform only 5G-UE related tests including physims excluding LDPC tests)\n"
-              message += "- ${gitBaseUrl}/labels/CI (perform both 4G and 5G tests)\n"
-              githubPRComment comment: githubPRMessage(message)
-              error('Not performing CI due to lack of mandatory labels')
-            }
             if (env.GITHUB_PR_LABELS.contains('CI')) {
               do4Gtest = true
               do5Gtest = true