Skip to content

docs: add Signed commits section to CONTRIBUTING - #82

Merged
hyperpolymath merged 1 commit into
mainfrom
docs/signing-policy-d218
Oct 1, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
docs/signing-policy-d218

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Adds a Signed commits section to this repo's CONTRIBUTING, per owner ruling D218. The estate policy is docs/SIGNING-POLICY.adoc in hyperpolymath/standards.

This repo's default branch is covered by the zero-bypass Require-Signed-Commits ruleset, and rebase-merge is off. The section tells contributors what that requires:

  • People and interactive agents sign with an SSH signing key.
  • Apps, bots and workflows write through the API, so GitHub signs their commits.
  • PRs are merged with squash.

If the file already had its own signing section, that section is replaced in place instead of adding a second one. Lines elsewhere that told people to sign with GPG are changed to match the policy (SSH for people).

This is a docs-only change. The commit was created through createCommitOnBranch, so GitHub signs it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

Owner ruling D218. See docs/SIGNING-POLICY.adoc in hyperpolymath/standards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f
@coderabbitai

coderabbitai Bot commented Oct 1, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 0fa43cc5-5ae8-48b3-8ddf-77d908fdf0d1

📥 Commits

Reviewing files that changed from the base of the PR and between 9780f00 and c38b6b4.

📒 Files selected for processing (1)
  • CONTRIBUTING.adoc

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (25)
  • GitHub Check: governance / Code quality + docs
  • GitHub Check: governance / Debt ratchet
  • GitHub Check: governance / Trusted-base reduction policy
  • GitHub Check: governance / Actions lockfile verify
  • GitHub Check: governance / Language / package anti-pattern policy
  • GitHub Check: governance / Licence consistency
  • GitHub Check: governance / Check Workflow Staleness
  • GitHub Check: governance / Guix packaging policy (Nix retired)
  • GitHub Check: governance / Security policy checks
  • GitHub Check: governance / Live Actions policy (credentialed advisory)
  • GitHub Check: governance / Allowlist Preflight
  • GitHub Check: governance / Exemption ratchet
  • GitHub Check: governance / Well-Known (RFC 9116 + RSR)
  • GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
  • GitHub Check: governance / Workflow security linter
  • GitHub Check: scan / shell-secrets
  • GitHub Check: scan / gitleaks
  • GitHub Check: scan / rust-secrets
  • GitHub Check: Validate DEED manifests
  • GitHub Check: Empty-linter (invisible characters)
  • GitHub Check: Groove manifest check
  • GitHub Check: Validate K9 contracts
  • GitHub Check: check
  • GitHub Check: analyze (javascript-typescript, none)
  • GitHub Check: semgrep-cloud-platform/scan
⚠️ CI failures not shown inline (2)

GitHub Actions: CodeQL Security Analysis / 0_analyze (javascript-typescript, none).txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Finalizing javascript
 [command]/opt/hostedtoolcache/CodeQL/2.27.1/x64/codeql/codeql database finalize --finalize-dataset --threads=4 --ram=14575 /home/runner/work/_temp/codeql_databases/javascript
 Error: CodeQL could not process any code written in JavaScript/TypeScript. For more information, review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build .
 ##[error]Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.27.1/x64/codeql/codeql database finalize --finalize-dataset --threads=4 --ram=14575 /home/runner/work/_temp/codeql_databases/javascript". Exit code was 32 and last log line was: Error: CodeQL could not process any code written in JavaScript/TypeScript. For more information, review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build . See the logs for more details.

GitHub Actions: CodeQL Security Analysis / analyze (javascript-typescript, none): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Finalizing javascript
 [command]/opt/hostedtoolcache/CodeQL/2.27.1/x64/codeql/codeql database finalize --finalize-dataset --threads=4 --ram=14575 /home/runner/work/_temp/codeql_databases/javascript
 Error: CodeQL could not process any code written in JavaScript/TypeScript. For more information, review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build .
 ##[error]Encountered a fatal error while running "/opt/hostedtoolcache/CodeQL/2.27.1/x64/codeql/codeql database finalize --finalize-dataset --threads=4 --ram=14575 /home/runner/work/_temp/codeql_databases/javascript". Exit code was 32 and last log line was: Error: CodeQL could not process any code written in JavaScript/TypeScript. For more information, review our troubleshooting guide at https://gh.io/troubleshooting-code-scanning/no-source-code-seen-during-build . See the logs for more details.
🔇 Additional comments (1)
CONTRIBUTING.adoc (1)

115-116: 🗄️ Data Integrity & Integration

Qualify the merge-setting statements.

The active Require-Signed-Commits ruleset supports the signed-commit statement. The repository API returns null for both allow_rebase_merge and allow_squash_merge, so the text cannot present squash-only merging or disabled rebase merging as current behaviour. State these as policy requirements unless the repository settings are available.


📝 Summary

Summary by CodeRabbit

  • Documentation
    • Added contribution guidance requiring signed commits for changes to the default branch.
    • Clarified signing requirements for people, automated tools and workflows, including the use of a verified committer email.
    • Documented that pull requests should be squash-merged, unsigned commits must be recreated as signed commits, and rebase merging is unavailable.

Walkthrough

The contribution guide now documents signed-commit requirements, signing options for people and automated actors, and merge guidance for pull requests.

Changes

Commit Signing Guidance

Layer / File(s) Summary
Signing requirements and merge guidance
CONTRIBUTING.adoc
The guide specifies signing requirements and methods for people, interactive agents, apps, bots and workflows. It also describes squash merges, recreating unsigned commits with git cherry-pick -S, and the disabled rebase-merge option.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to c38b6

The guide clarifies signing requirements and contributor workflows. No concrete merge-blocking issue is established; the repository’s current merge-method settings remain unconfirmed.

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the documentation change to CONTRIBUTING.
Description check ✅ Passed The description accurately explains the signed-commit policy, SSH signing guidance, API-based commits, squash merges, and the documentation-only scope.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks each commit’s mark,
Then signs its work before the dark.
It hops through squash and leaves a note,
“Signed commits help this change to float.”
The guide now tells the path to take.

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath merged commit b233fbf into main Oct 1, 2026
30 of 33 checks passed
@hyperpolymath
hyperpolymath deleted the docs/signing-policy-d218 branch October 1, 2026 19:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant