This repository was archived by the owner on Sep 1, 2026. It is now read-only.

re-sign seeds (origin+identity-bound signing) + sync hardened verifier #6

	name: Verify learnings

	# Re-verify every contributed learning on each PR and push. This is the safety
	# gate: it independently recomputes content-addressed ids, checks signatures, and
	# re-runs the scrub so nothing tampered, unsigned, or identifying can merge.
	#
	# The verifier is VENDORED at .github/scripts/verify.py (only blake3 + pynacl from
	# PyPI) so this repo verifies itself with no dependency on the komi-learn package.

	on:
	pull_request:
	paths: ["learnings/**"]
	push:
	branches: [main]
	paths: ["learnings/**"]

	permissions:
	contents: read

	jobs:
	verify:
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4
	with:
	fetch-depth: 0 # need base to diff changed files on PRs

	- uses: actions/setup-python@v5
	with:
	python-version: "3.12"

	- name: Install verifier dependencies
	run: python -m pip install --upgrade pip blake3 pynacl

	- name: Determine changed learning files (PRs)
	id: changed
	if: github.event_name == 'pull_request'
	run: \|
	BASE="${{ github.event.pull_request.base.sha }}"
	FILES=$(git diff --name-only --diff-filter=ACM "$BASE"...HEAD -- 'learnings/*/.md' \| tr '\n' ' ')
	echo "files=$FILES" >> "$GITHUB_OUTPUT"

	- name: Verify changed files (PR)
	if: github.event_name == 'pull_request'
	run: \|
	if [ -z "${{ steps.changed.outputs.files }}" ]; then
	echo "No learning files changed."
	else
	python .github/scripts/verify.py --changed ${{ steps.changed.outputs.files }}
	fi

	- name: Verify all files (push to main)
	if: github.event_name == 'push'
	run: python .github/scripts/verify.py

Navigation Menu