Skip to main content

Expose Commit Signing Status to the `GIT_PUSH` policy

Feature RequestsVCSPolicies

We’re working on various security hardening efforts, and would love to be able to require verified commits be a precondition to spacelift planning/tracking a run.

For tracked runs we can get this as a side-effect of our github policy on main but for proposed runs on branches, this doesn’t appear to be possible.

This is valuable to us because it adds an additional layer of security in the case of any supply chain attack that results in malicious providers being proposed, since a malicious provider would still have access to the entire env.

Workaround
No
Problem
Status: 🔭 Discovery2 comments

Log in to comment and vote

Comments2

  • Aleksandra Cieslak

    Team•

    Nov 2

    Hi,

    I'm a PM at Spacelift. I'm looking into your request and would love to learn more about your use case.

    Would you have 30 minutes for a call? Feel free to pick a time here: [calendar link]

  • Tomato Oak

    •

    Apr 21

    For anyone approaching this feature request via search in future, it is possible to work around this limitation at the source, by requiring ALL commits to ALL branches to include verified commits, for instance with Github this is something that can be achieve with a dedicated ruleset that matches all branches.