Create block-unapproved-emails.yaml

Author: ssivanupandian

.github/workflows/block-unapproved-emails.yaml

@@ -0,0 +1,66 @@
+name: Enforce Commit Email and Signature Policy
+
+on:
+  push:
+  pull_request:
+    types: [opened, synchronize, reopened]
+
+jobs:
+  check-commits:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Validate commits
+        run: |
+          set -e
+
+          echo "Event: ${{ github.event_name }}"
+
+          if [[ "${{ github.event_name }}" == "pull_request" ]]; then
+            BASE_SHA="${{ github.event.pull_request.base.sha }}"
+            HEAD_SHA="${{ github.event.pull_request.head.sha }}"
+          elif [[ "${{ github.event_name }}" == "push" ]]; then
+            BASE_SHA="${{ github.event.before }}"
+            HEAD_SHA="${{ github.event.after }}"
+          else
+            echo "Unsupported event: ${{ github.event_name }}"
+            exit 1
+          fi
+
+          echo "Checking commits between $BASE_SHA and $HEAD_SHA..."
+
+          BLOCKED=false
+
+          git log ${BASE_SHA}..${HEAD_SHA} --pretty=format:"%H|%ae|%G?|%GS" | while IFS="|" read -r hash email sig_status signer; do
+            echo "➡ Commit: $hash"
+            echo "   Author Email: $email"
+            echo "   Signature: $sig_status by $signer"
+
+            # Check approved emails
+            if [[ "$email" == *@hitachivantara.com ]] || [[ "$email" == *@hitachids.com ]] || [[ "$email" =~ @users\.noreply\.github\.com$ ]] || [[ "$email" == "noreply@github.com" ]]; then
+              echo "Allowed email domain"
+            else
+              echo "Blocked email domain: $email"
+              BLOCKED=true
+            fi
+
+            # Signature check
+            if [[ "$sig_status" != "G" && "$sig_status" != "U" ]]; then
+              echo "Commit not signed or not verified"
+              BLOCKED=true
+            else
+              echo "Commit is signed and verified"
+            fi
+          done
+
+          if [ "$BLOCKED" = true ]; then
+            echo "One or more commits have unauthorized emails or are not properly signed."
+            exit 1
+          else
+            echo "All commits pass policy checks."
+          fi