From 2aab5731b52e34090adba0d0bdaaa91c8bb3e837 Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 1 Oct 2026 08:14:08 +0100 Subject: [PATCH 1/4] docs: add Signed commits section to CONTRIBUTING Owner ruling D218. See docs/SIGNING-POLICY.adoc in hyperpolymath/standards. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f --- .github/CONTRIBUTING.md | 17 +++++++++++++++++ CONTRIBUTING.adoc | 17 +++++++++++++++++ 2 files changed, 34 insertions(+) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index ed6038d..f6915db 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -119,3 +119,20 @@ We follow [Conventional Commits](https://www.conventionalcommits.org/): [optional body] [optional footer] + +## Signed commits + +Every commit that reaches the default branch must be signed; a ruleset refuses +unsigned pushes. Estate policy: +[SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc). + +- **People and interactive agents** sign with an SSH key registered on GitHub + as a *signing* key (`gpg.format=ssh`, `user.signingkey=.pub`, + `commit.gpgsign=true`). The committer email must be verified on that account. +- **Apps, bots and workflows** never `git push` local commits. They write + through the API (`createCommitOnBranch` or the estate `signed-push` action) + so that GitHub signs each commit. +- Merge PRs with **squash**. The ruleset checks every commit on the PR branch, + not just the result, so one unsigned commit blocks the merge. Re-create such a + branch with signed commits (`git cherry-pick -S`) and open a new PR. + Rebase-merge replays commits unsigned and is disabled. diff --git a/CONTRIBUTING.adoc b/CONTRIBUTING.adoc index 5949bf0..e8bd679 100644 --- a/CONTRIBUTING.adoc +++ b/CONTRIBUTING.adoc @@ -7,3 +7,20 @@ . Submit a pull request *Author:* Jonathan D.A. Jewell j.d.a.jewell@open.ac.uk + +== Signed commits + +Every commit that reaches the default branch must be signed; a ruleset refuses +unsigned pushes. Estate policy: +https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc[SIGNING-POLICY]. + +* **People and interactive agents** sign with an SSH key registered on GitHub + as a *signing* key (`gpg.format=ssh`, `user.signingkey=.pub`, + `commit.gpgsign=true`). The committer email must be verified on that account. +* **Apps, bots and workflows** never `git push` local commits. They write + through the API (`createCommitOnBranch` or the estate `signed-push` action) + so that GitHub signs each commit. +* Merge PRs with **squash**. The ruleset checks every commit on the PR branch, + not just the result, so one unsigned commit blocks the merge. Re-create such a + branch with signed commits (`git cherry-pick -S`) and open a new PR. + Rebase-merge replays commits unsigned and is disabled. From 2d235282cdd91112c3a740cf3ae98093db8eadfa Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 1 Oct 2026 22:35:23 +0100 Subject: [PATCH 2/4] Update .github/CONTRIBUTING.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- .github/CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/CONTRIBUTING.md b/.github/CONTRIBUTING.md index f6915db..5006692 100644 --- a/.github/CONTRIBUTING.md +++ b/.github/CONTRIBUTING.md @@ -135,4 +135,4 @@ unsigned pushes. Estate policy: - Merge PRs with **squash**. The ruleset checks every commit on the PR branch, not just the result, so one unsigned commit blocks the merge. Re-create such a branch with signed commits (`git cherry-pick -S`) and open a new PR. - Rebase-merge replays commits unsigned and is disabled. + Rebase-merge is enabled in the tracked repository settings. The repository still requires signed commits on the default branch. From 24577d3174e29d172bb2046811b6584ff034036c Mon Sep 17 00:00:00 2001 From: "Jonathan D.A. Jewell" <6759885+hyperpolymath@users.noreply.github.com> Date: Thu, 1 Oct 2026 22:35:37 +0100 Subject: [PATCH 3/4] Update CONTRIBUTING.adoc Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Jonathan D.A. Jewell <6759885+hyperpolymath@users.noreply.github.com> --- CONTRIBUTING.adoc | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/CONTRIBUTING.adoc b/CONTRIBUTING.adoc index e8bd679..cf12185 100644 --- a/CONTRIBUTING.adoc +++ b/CONTRIBUTING.adoc @@ -21,6 +21,8 @@ https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc[SI through the API (`createCommitOnBranch` or the estate `signed-push` action) so that GitHub signs each commit. * Merge PRs with **squash**. The ruleset checks every commit on the PR branch, - not just the result, so one unsigned commit blocks the merge. Re-create such a - branch with signed commits (`git cherry-pick -S`) and open a new PR. + not just the result, so one unsigned commit blocks the merge. Rewrite the PR + branch with signed commits (`git cherry-pick -S`), or squash and sign it + locally, then push the updated branch. Create a new PR only when the existing + PR branch cannot be rewritten. Rebase-merge replays commits unsigned and is disabled. From 182729ce0cc5d94ddfa1c8e010082e764d089664 Mon Sep 17 00:00:00 2001 From: "coderabbitai[bot]" <136622811+coderabbitai[bot]@users.noreply.github.com> Date: Thu, 1 Oct 2026 21:38:27 +0000 Subject: [PATCH 4/4] docs(contributing): clarify that rebase-merge is enabled and default-branch commits must remain signed --- CONTRIBUTING.adoc | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/CONTRIBUTING.adoc b/CONTRIBUTING.adoc index cf12185..bb1a67d 100644 --- a/CONTRIBUTING.adoc +++ b/CONTRIBUTING.adoc @@ -25,4 +25,5 @@ https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc[SI branch with signed commits (`git cherry-pick -S`), or squash and sign it locally, then push the updated branch. Create a new PR only when the existing PR branch cannot be rewritten. - Rebase-merge replays commits unsigned and is disabled. + Rebase-merge is enabled in the tracked repository settings. The repository + still requires signed commits on the default branch.