[Due for payment 2026-01-23] [$125] `verifySignedCommits` doesn't paginate commits and can thus miss unsigned commits

[francoisl]

Problem

The verifySignedCommits workflow doesn't paginate commits, so if a PR has more than 30 commits (default value for per_page), it doesn't properly detect unsigned commits after the 30^th.

Repro steps

1. Create a fresh branch
2. Create 30 signed commits, then an unsigned one (this assumes your git config already has signature enabled by default)

   # Create 30 signed commits on a new branch
   for i in {1..30}; do
       git commit --allow-empty -m "Test commit $i"
   done
   
   # Create an unsigned commit
   git commit --no-gpg-sign --allow-empty -m "Unsigned commit test"

3. Run the verifySignedCommits workflow
4. Notice that it passes

Example PR – workflow passes despite unsigned 31^st commit

Solution

Use octokit's pagination functionality to get all commits on the PR.

Upwork Automation - Do Not Edit

• Upwork Job URL: https://www.upwork.com/jobs/~022008688139822676909
• Upwork Job ID: 2008688139822676909
• Last Price Increase: 2026-01-06
• Automatic offers:
• linhvovan29546 | Reviewer | 110029544

Issue Owner

Current Issue Owner: @

Issue Owner

Current Issue Owner: @CortneyOfstad

[melvin-bot]

Triggered auto assignment to @CortneyOfstad (Bug), see https://stackoverflow.com/c/expensify/questions/14418 for more details. Please add this bug to a GH project, as outlined in the SO.

[melvin-bot]

Job added to Upwork: https://www.upwork.com/jobs/~022008688139822676909

[melvin-bot]

Triggered auto assignment to Contributor-plus team member for initial proposal review - @linhvovan29546 (External)

[PiyushChandra17]

I'd like to work on this, the solution is already detailed in OP.