feat(search): add navigation shortcuts to global search - #331
Closed
Iyamokuma wants to merge 2 commits into
Closed
Conversation
Member
|
@Iyamokuma Handle the Failing CI and also sign your commit, it should show VERIFIED in github |
This was referenced Aug 17, 2026
Member
|
@Iyamokuma Please sign your commits |
added 2 commits
August 19, 2026 06:09
Index permission-filtered sidebar routes so administrators can jump to settings pages like Offices or Chart of Accounts from the header and /search page.
Keep main's searchRoutes ranking and developer-tools tests alongside the navigation shortcut feature, and adopt upstream savings account routing in the header search.
Iyamokuma
force-pushed
the
feat/global-search-nav-shortcuts
branch
from
August 20, 2026 11:19
a72a147 to
27b8948
Compare
Member
|
No user is associated with the committer email. |
Member
|
see #392 |
Aman-Mittal
added a commit
that referenced
this pull request
Aug 22, 2026
… on the PR Closes #428. The signed-commit gate passed anything whose `%G?` was not `N`, which asks "is a signature attached?". GitHub asks whether the signature was made by a key registered to an account whose verified email matches the committer, and a commit passes the first while failing the second routinely — #392 and #331 are both green on the check with every commit showing Unverified. A runner cannot answer the stricter question: it holds no contributor public keys. It does not need to. GitHub has already computed the answer and returns it per commit as `commit.verification`, so the check now asks for that. The gate also has to stop being editable by the branch it gates. Under `pull_request` the workflow and its scripts come from the merge ref, so a contributor can weaken their own check — which is how the accept-any-`gpgsig` fallback in #392 came about. `pull_request_target` runs the base repository's copy and carries a token that can comment, which a fork's `pull_request` run deliberately does not. Neither workflow checks out or executes the PR's code; both take a ref-less sparse checkout of `.github/scripts` and read only the API. zizmor passes at the repository's own settings, with the two `dangerous-triggers` ignores justified inline. Failures now explain themselves on the PR, grouped by `verification.reason`, because the remedies are not interchangeable. `no_user` — the reason on both affected PRs — is not a signing problem at all: the signature is fine and `user.email` is not an address on any GitHub account, so telling those contributors to set up signing sends them to redo the part they got right. One comment per PR, updated on push and deleted once every commit verifies. `scripts/verify-signed-commits.sh` stays as a local pre-push aid, with a header saying plainly that it is no longer the gate and cannot be one. The welcome workflow covers the other half of the manual work: a first-time contributor gets the code of conduct, the dev list, the Matrix rooms and the handful of requirements that most often block a first change. It is short on purpose — CONTRIBUTING.md and the PR template already state everything, and restating all of it is repeating something that demonstrably does not land. Neither workflow can be exercised by the PR that adds it, since `pull_request_target` only ever runs the base branch's copy, so the unit tests are the whole pre-merge safety net: comment idempotency, deletion on success, never overwriting a human comment, and defusing `@`/`#` in attacker-controlled commit subjects. Both scripts were also run against the live API for #392 and #393 to confirm the verdict and the rendered comment. Branch protection's "Require signed commits" remains the thing worth turning on: GitHub enforces it itself and no workflow can weaken it. This check is the explanation, not the wall.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Index permission-filtered sidebar routes so administrators can jump to settings pages like Offices or Chart of Accounts from the header and /search page.
What and why
Closes #
Verification
Screenshots
Checklist
src/app/api/.src/app/core/adapters/instead of direct browser globals or imperative third-party APIs.