Skip to content

Commit bee0790

Browse files
hyperpolymathclaude
hyperpolymath
and
claude
authored
docs: add Signed commits section to CONTRIBUTING (#86)
Adds a **Signed commits** section to this repo's CONTRIBUTING, per owner ruling **D218**. The estate policy is [`docs/SIGNING-POLICY.adoc`](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc) in hyperpolymath/standards. This repo's default branch is covered by the zero-bypass `Require-Signed-Commits` ruleset, and rebase-merge is off. The section tells contributors what that requires: - People and interactive agents sign with an SSH signing key. - Apps, bots and workflows write through the API, so GitHub signs their commits. - PRs are merged with squash. This is a docs-only change. The commit was created through `createCommitOnBranch`, so GitHub signs it. 🤖 Generated with [Claude Code](https://claude.com/claude-code) https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
1 parent a7218b6 commit bee0790

2 files changed

Lines changed: 34 additions & 0 deletions

File tree

‎.github/CONTRIBUTING.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -119,3 +119,20 @@ We follow [Conventional Commits](https://www.conventionalcommits.org/):
119119
[optional body]
120120

121121
[optional footer]
122+
123+
## Signed commits
124+
125+
Every commit that reaches the default branch must be signed; a ruleset refuses
126+
unsigned pushes. Estate policy:
127+
[SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc).
128+
129+
- **People and interactive agents** sign with an SSH key registered on GitHub
130+
as a *signing* key (`gpg.format=ssh`, `user.signingkey=<key>.pub`,
131+
`commit.gpgsign=true`). The committer email must be verified on that account.
132+
- **Apps, bots and workflows** never `git push` local commits. They write
133+
through the API (`createCommitOnBranch` or the estate `signed-push` action)
134+
so that GitHub signs each commit.
135+
- Merge PRs with **squash**. The ruleset checks every commit on the PR branch,
136+
not just the result, so one unsigned commit blocks the merge. Re-create such a
137+
branch with signed commits (`git cherry-pick -S`) and open a new PR.
138+
Rebase-merge replays commits unsigned and is disabled.

‎CONTRIBUTING.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,3 +7,20 @@
77
4. Submit a pull request
88

99
**Author:** Jonathan D.A. Jewell <j.d.a.jewell@open.ac.uk>
10+
11+
## Signed commits
12+
13+
Every commit that reaches the default branch must be signed; a ruleset refuses
14+
unsigned pushes. Estate policy:
15+
[SIGNING-POLICY](https://github.com/hyperpolymath/standards/blob/main/docs/SIGNING-POLICY.adoc).
16+
17+
- **People and interactive agents** sign with an SSH key registered on GitHub
18+
as a *signing* key (`gpg.format=ssh`, `user.signingkey=<key>.pub`,
19+
`commit.gpgsign=true`). The committer email must be verified on that account.
20+
- **Apps, bots and workflows** never `git push` local commits. They write
21+
through the API (`createCommitOnBranch` or the estate `signed-push` action)
22+
so that GitHub signs each commit.
23+
- Merge PRs with **squash**. The ruleset checks every commit on the PR branch,
24+
not just the result, so one unsigned commit blocks the merge. Re-create such a
25+
branch with signed commits (`git cherry-pick -S`) and open a new PR.
26+
Rebase-merge replays commits unsigned and is disabled.

0 commit comments

Comments
 (0)