Module checks 

The check the bridge posts itself (§9, “forged check runs”).

Where no org required workflow is available, a check pinned to the GitHub Actions App is forgeable: any writer can run a workflow on another branch that posts a passing “Verify commit trust” run onto someone else’s pull request. So the bridge runs verify-trust itself and posts the check as the community’s App, and the ruleset requires the check from that App (crate::GitHubConfig::bridge_checks).

This module is the GitHub half of that: recognising the deliveries that call for a check (GitHubForge::parse_check_trigger, signature first), listing the commits under test (GitHubForge::compare_commits), a read-only token for fetching them (GitHubForge::contents_read_token), and the check run itself (GitHubForge::start_check_run, GitHubForge::finish_check_run). Running verify-trust is the bridge’s.

Every token here is minted for the one repository and the one permission the call needs, and dropped on return — except the contents token, which the caller holds for exactly one fetch.

Structs

CheckTrigger

A verified delivery that calls for the check on head_sha, against the base branch base_ref.

Comparison

The commits between a base and a head, as GitHub lists them.

PullRequestInfo

A pull request as GitHub reports it now.

Enums

CheckConclusion

How a check run ended.

CheckTriggerKind

Why a check is due.

Functions

check_sha

A git object id: 40 (SHA-1) or 64 (SHA-256) lowercase hex. Checked before it goes into a URL or a git command line.