Repository navigation
Workflow drift detected — unsigned commits touched .github/ #3
Description
Workflow drift alert
The scheduled drift-detection scan found unsigned commits modifying .github/ in the past 7 days:
- 003ec18 (johnny+github@johnnyxmas.net): unsigned commit touched .github/workflows/ci.yml
- db9b599 (johnny+github@johnnyxmas.net): unsigned commit touched .github/workflows/workflow-drift-detection.yml
Please review these commits immediately and verify they are legitimate.
This issue was opened automatically by the drift-detection workflow.
Activity
fix(ci): verify commit signatures via the GitHub API, not git verify-…
johnnyxmas commentedon Sep 9, 2026
False positive: the drift check ran
git verify-commiton the runner, which cannot verify SSH-signed commits without a local allowed_signers file. Fixed in #5 — it now reads signature status from the GitHub API.