Skip to main content

Expose Commit Signing Status to the `GIT_PUSH` policy

Feature RequestsVCSPolicies

We’re working on various security hardening efforts, and would love to be able to require verified commits be a precondition to spacelift planning/tracking a run.

For tracked runs we can get this as a side-effect of our github policy on main but for proposed runs on branches, this doesn’t appear to be possible.

This is valuable to us because it adds an additional layer of security in the case of any supply chain attack that results in malicious providers being proposed, since a malicious provider would still have access to the entire env.

Workaround
No
Problem
1 comment

Log in to comment and vote

Comments1

  • Tomato Oak

    •

    Apr 21

    For anyone approaching this feature request via search in future, it is possible to work around this limitation at the source, by requiring ALL commits to ALL branches to include verified commits, for instance with Github this is something that can be achieve with a dedicated ruleset that matches all branches.