DSPX-3636 update quickstart Keycloak docs #384

	name: Commit Signatures

	on:
	pull_request:
	types: [opened, synchronize, reopened]

	jobs:
	check:
	name: Verify signed commits
	runs-on: ubuntu-latest
	steps:
	- name: Check commit signatures
	uses: actions/github-script@v7
	with:
	script: \|
	const commits = await github.paginate(
	github.rest.pulls.listCommits,
	{
	owner: context.repo.owner,
	repo: context.repo.repo,
	pull_number: context.issue.number,
	}
	);

	const unsigned = commits.filter(c => !c.commit.verification.verified);

	if (unsigned.length === 0) {
	core.info(`All ${commits.length} commit(s) have verified signatures.`);
	return;
	}

	const list = unsigned
	.map(c => `- \`${c.sha.slice(0, 7)}\` ${c.commit.message.split('\n')[0]} — reason: ${c.commit.verification.reason}`)
	.join('\n');

	core.setFailed(
	`${unsigned.length} of ${commits.length} commit(s) do not have verified signatures:\n\n` +
	`${list}\n\n` +
	`This repository requires cryptographic commit signatures (GPG or SSH).\n` +
	`This is separate from the DCO sign-off (git commit -s).\n\n` +
	`To set up SSH signing (recommended):\n` +
	` 1. git config --global gpg.format ssh\n` +
	` 2. git config --global user.signingkey ~/.ssh/id_ed25519.pub\n` +
	` 3. git config --global commit.gpgsign true\n` +
	` 4. Add the same key as a Signing Key in GitHub → Settings → SSH and GPG keys\n\n` +
	`To re-sign existing commits:\n` +
	` git rebase --exec 'git commit --amend --no-edit -S' origin/main\n` +
	` git push --force-with-lease\n\n` +
	`See: https://docs.github.com/en/authentication/managing-commit-signature-verification`
	);

Provide feedback