1. VerifyMergeable was incorrectly returning an error when no verifiers were
found (for an unprotected base branch).
2. Policy's searcher interface was also returning the wrong error when the
latest policy or attestation entry was not found.
3. A verify-mergeable command has been added to simplify debugging.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
These workflows have some shortcomings, as discussed in
https://github.com/gittuf/gittuf/issues/384#issuecomment-2099153472.
verify-commit doesn't currently do enough to ensure the right policy is
identified for when a commit is first introduced. verify-ref, with some
enhancements, is better.
verify-tag implements a subset of verify-ref already because it recognizes tags
are refs. Thus, verify-ref is again a better option.
Signed-off-by: Aditya Sirish A Yelgundhalli <ayelgundhall@bloomberg.net>
