1# forge.requireci tip: main moves only to a tree with a verified passing2# attestation, signed by a registered key; a failing one is turned away.3. "$(dirname "$0")/../lib.sh"4user dami5repo dami/greet6git --git-dir="$FORGE_ROOT/dami/greet.git" config forge.requireci tip7clone dami dami/greet "$T/w/d"8mkdir -p "$T/w/d/.forge"9printf '#!/bin/sh\ntest -f ok\n' >"$T/w/d/.forge/ci"10chmod +x "$T/w/d/.forge/ci"11at "$T/w/d" commit "ci script, no ok file yet"12export FORGE_USER=dami13fails_with "has no verified passing CI attestation" push_as dami "$T/w/d" origin main14fails at "$T/w/d" "$FORGE" attest15fails_with "has no verified passing CI attestation" push_as dami "$T/w/d" origin main refs/notes/ci16at "$T/w/d" commit "add ok" ok17ok at "$T/w/d" "$FORGE" attest18ok at "$T/w/d" "$FORGE" verify19ok push_as dami "$T/w/d" origin main refs/notes/ci20eq "$(git --git-dir="$FORGE_ROOT/dami/greet.git" rev-parse main)" "$(git -C "$T/w/d" rev-parse HEAD)"