Skip to content

docs: add Signed commits section to CONTRIBUTING - #3

Merged
hyperpolymath merged 1 commit into
mainfrom
docs/signing-policy-d218
Oct 1, 2026
Merged

docs: add Signed commits section to CONTRIBUTING#3
hyperpolymath merged 1 commit into
mainfrom
docs/signing-policy-d218

Conversation

@hyperpolymath

@hyperpolymath hyperpolymath commented Oct 1, 2026

Copy link
Copy Markdown
Owner

Adds a Signed commits section to this repo's CONTRIBUTING, per owner ruling D218. The estate policy is docs/SIGNING-POLICY.adoc in hyperpolymath/standards.

This repo's default branch is covered by the zero-bypass Require-Signed-Commits ruleset, and rebase-merge is off. The section tells contributors what that requires:

  • People and interactive agents sign with an SSH signing key.
  • Apps, bots and workflows write through the API, so GitHub signs their commits.
  • PRs are merged with squash.

If the file already had its own signing section, that section is replaced in place instead of adding a second one. Lines elsewhere that told people to sign with GPG are changed to match the policy (SSH for people).

This is a docs-only change. The commit was created through createCommitOnBranch, so GitHub signs it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

@hyperpolymath @claude
docs: add Signed commits section to CONTRIBUTING
3cce50a 
Owner ruling D218. See docs/SIGNING-POLICY.adoc in hyperpolymath/standards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f
@coderabbitai

coderabbitai Bot commented Oct 1, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 891adc95-1bbc-4702-b27b-2048a8488fa3

📥 Commits

Reviewing files that changed from the base of the PR and between 55a60d0 and 3cce50a.

📒 Files selected for processing (2)
  • .github/CONTRIBUTING.md
  • CONTRIBUTING.adoc

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (26)
  • GitHub Check: governance / Actions lockfile verify
  • GitHub Check: governance / Trusted-base reduction policy
  • GitHub Check: governance / Exemption ratchet
  • GitHub Check: governance / Code quality + docs
  • GitHub Check: governance / Licence consistency
  • GitHub Check: governance / Debt ratchet
  • GitHub Check: governance / Well-Known (RFC 9116 + RSR)
  • GitHub Check: governance / Guix packaging policy (Nix retired)
  • GitHub Check: governance / Workflow security linter
  • GitHub Check: governance / Allowlist Preflight
  • GitHub Check: governance / Live Actions policy (credentialed advisory)
  • GitHub Check: governance / Security policy checks
  • GitHub Check: governance / Check Workflow Staleness
  • GitHub Check: governance / Language / package anti-pattern policy
  • GitHub Check: call-estate-audit / estate-audit
  • GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
  • GitHub Check: RSR oracle — dogfood this repo
  • GitHub Check: 🟡 CHECK: Groove manifest check
  • GitHub Check: Validate eclexiaiser manifest
  • GitHub Check: Hypatia neurosymbolic scan
  • GitHub Check: Validate K9 contracts
  • GitHub Check: 🟡 CHECK: Groove manifest check
  • GitHub Check: estate-rules
  • GitHub Check: Dogfooding compliance summary
  • GitHub Check: lint
  • GitHub Check: 🟡 CHECK: Validate K9 contracts
⚠️ CI failures not shown inline (26)

GitHub Actions: Lock Sync Gate / 0_actions.lock is in sync with the workflow YAML.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mtest -x scripts/check-lock-sync.sh \�[0m
 �[36;1m  || { echo "::error::scripts/check-lock-sync.sh missing or not executable"; exit 1; }�[0m

GitHub Actions: Central Estate CI/CD Audit / 0_call-estate-audit _ estate-audit.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run # Accepted placements widened per owner ruling 2026-09-19: estate
 �[36;1m# Accepted placements widened per owner ruling 2026-09-19: estate�[0m
 �[36;1m# repos legitimately keep governance docs under docs/ (and GitHub�[0m
 �[36;1m# renders under .github/) — rsr-template-repo itself was failing on�[0m
 �[36;1m# layout, not on substance. Root forms still win (first hit).�[0m
 �[36;1m# Template-repo mode: see below.�[0m
 �[36;1m#�[0m
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- template-repo mode -------------------------------------------�[0m
 �[36;1m# An un-instantiated template legitimately SHIPS {{OWNER}}/{{AUTHOR}}�[0m
 �[36;1m# placeholders and self-references its own template name; judging it�[0m
 �[36;1m# like an instantiated repo is a category error. Detection is explicit�[0m
 �[36;1m# and auditable: the repo name says it is a temp...

GitHub Actions: Lock Sync Gate / actions.lock is in sync with the workflow YAML: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run set -euo pipefail
 �[36;1mset -euo pipefail�[0m
 �[36;1mtest -x scripts/check-lock-sync.sh \�[0m
 �[36;1m  || { echo "::error::scripts/check-lock-sync.sh missing or not executable"; exit 1; }�[0m

GitHub Actions: Central Estate CI/CD Audit / call-estate-audit _ estate-audit: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run # Accepted placements widened per owner ruling 2026-09-19: estate
 �[36;1m# Accepted placements widened per owner ruling 2026-09-19: estate�[0m
 �[36;1m# repos legitimately keep governance docs under docs/ (and GitHub�[0m
 �[36;1m# renders under .github/) — rsr-template-repo itself was failing on�[0m
 �[36;1m# layout, not on substance. Root forms still win (first hit).�[0m
 �[36;1m# Template-repo mode: see below.�[0m
 �[36;1m#�[0m
 �[36;1m# Presence-only checking rewards filler. This gate previously demanded�[0m
 �[36;1m# ARCHITECTURE.md / MAINTAINERS.adoc / GOVERNANCE.md and checked only�[0m
 �[36;1m# that the paths existed — so the cheapest way to pass was to commit�[0m
 �[36;1m# template boilerplate. That happened: an estate repo acquired an�[0m
 �[36;1m# ARCHITECTURE.md describing a directory layout it does not have, a�[0m
 �[36;1m# MAINTAINERS naming a different account as owner, and a mise.toml�[0m
 �[36;1m# pinning `zig = "latest"` against that repo's own .tool-versions.�[0m
 �[36;1m# All three would have passed. So: presence, THEN format, THEN substance.�[0m
 �[36;1m#�[0m
 �[36;1m# Format policy (estate):�[0m
 �[36;1m#   .adoc  documentation (default)�[0m
 �[36;1m#   .md    wiki content only — plus a transitional allowance for the�[0m
 �[36;1m#          GitHub-mandated files, which are migrating to berrywiki format�[0m
 �[36;1m#   .txt   licence texts�[0m
 �[36;1m#   fixed  names GitHub or convention dictates (CODEOWNERS, funding.yml,�[0m
 �[36;1m#          NOTICE, AUTHORS, MAINTAINERS) keep their form�[0m
 �[36;1mset -uo pipefail�[0m
 �[36;1mfail=0�[0m
 �[36;1m�[0m
 �[36;1m# --- template-repo mode -------------------------------------------�[0m
 �[36;1m# An un-instantiated template legitimately SHIPS {{OWNER}}/{{AUTHOR}}�[0m
 �[36;1m# placeholders and self-references its own template name; judging it�[0m
 �[36;1m# like an instantiated repo is a category error. Detection is explicit�[0m
 �[36;1m# and auditable: the repo name says it is a temp...

GitHub Actions: OpenSSF Compliance / 0_openssf-compliance.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SECFILE=""
 �[36;1mSECFILE=""�[0m
 �[36;1m[ -f "SECURITY.md" ] && SECFILE="SECURITY.md"�[0m
 �[36;1m[ -f "SECURITY.adoc" ] && SECFILE="SECURITY.adoc"�[0m
 �[36;1m[ -f ".github/SECURITY.md" ] && SECFILE=".github/SECURITY.md"�[0m
 �[36;1m�[0m
 �[36;1mif [ -z "$SECFILE" ]; then�[0m
 �[36;1m  echo "::error::SECURITY.md (or SECURITY.adoc) is required for OpenSSF Best Practices"�[0m

GitHub Actions: OpenSSF Compliance / openssf-compliance: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SECFILE=""
 �[36;1mSECFILE=""�[0m
 �[36;1m[ -f "SECURITY.md" ] && SECFILE="SECURITY.md"�[0m
 �[36;1m[ -f "SECURITY.adoc" ] && SECFILE="SECURITY.adoc"�[0m
 �[36;1m[ -f ".github/SECURITY.md" ] && SECFILE=".github/SECURITY.md"�[0m
 �[36;1m�[0m
 �[36;1mif [ -z "$SECFILE" ]; then�[0m
 �[36;1m  echo "::error::SECURITY.md (or SECURITY.adoc) is required for OpenSSF Best Practices"�[0m

GitHub Actions: OpenSSF Compliance / openssf-compliance: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run if [ ! -f "LICENSE" ] && [ ! -f "LICENSE.txt" ] && [ ! -f "LICENSE.md" ]; then
 �[36;1mif [ ! -f "LICENSE" ] && [ ! -f "LICENSE.txt" ] && [ ! -f "LICENSE.md" ]; then�[0m
 �[36;1m  echo "::error::LICENSE file is required for OpenSSF Best Practices"�[0m

GitHub Actions: OpenSSF Compliance / openssf-compliance: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run if [ ! -f "CONTRIBUTING.md" ] && [ ! -f "CONTRIBUTING.adoc" ] \
 �[36;1mif [ ! -f "CONTRIBUTING.md" ] && [ ! -f "CONTRIBUTING.adoc" ] \�[0m
 �[36;1m   && [ ! -f ".github/CONTRIBUTING.md" ] && [ ! -f ".github/CONTRIBUTING.adoc" ]; then�[0m
 �[36;1m  echo "::error::CONTRIBUTING file is required for OpenSSF Best Practices"�[0m

GitHub Actions: OpenSSF Compliance / openssf-compliance: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run if [ ! -f "README.md" ] && [ ! -f "README.adoc" ] && [ ! -f "README.rst" ] && [ ! -f "README.txt" ] && [ ! -f "README" ]; then
 �[36;1mif [ ! -f "README.md" ] && [ ! -f "README.adoc" ] && [ ! -f "README.rst" ] && [ ! -f "README.txt" ] && [ ! -f "README" ]; then�[0m
 �[36;1m  echo "::error::README file is required for OpenSSF Best Practices"�[0m

GitHub Actions: OpenSSF Compliance / openssf-compliance: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run if [ ! -d ".machine_readable" ]; then
 �[36;1mif [ ! -d ".machine_readable" ]; then�[0m
 �[36;1m  echo "::error::.machine_readable/ directory is required"�[0m

GitHub Actions: OpenSSF Compliance / openssf-compliance: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run if [ ! -f "CHANGELOG.md" ] && [ ! -f "CHANGELOG.adoc" ] && [ ! -f "CHANGES.md" ]; then
 �[36;1mif [ ! -f "CHANGELOG.md" ] && [ ! -f "CHANGELOG.adoc" ] && [ ! -f "CHANGES.md" ]; then�[0m
 �[36;1m  echo "::error::CHANGELOG.md is required for OpenSSF Best Practices"�[0m

GitHub Actions: OpenSSF Compliance / openssf-compliance: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run bash scripts/check-no-placeholders.sh .
 �[36;1mbash scripts/check-no-placeholders.sh .�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 FAIL: 93 file(s) contain unfilled {{PLACEHOLDER}} tokens:
   - .clinerules: {{AUTHOR_EMAIL}} {{AUTHOR}} {{CURRENT_YEAR}} {{OWNER}}
   - .cursorrules: {{AUTHOR_EMAIL}} {{AUTHOR}} {{CURRENT_YEAR}} {{OWNER}}
   - .devcontainer/Containerfile: {{AUTHOR_EMAIL}} {{AUTHOR}} {{CURRENT_YEAR}} {{OWNER}} {{PROJECT_NAME}}
   - .devcontainer/README.adoc: {{AUTHOR_EMAIL}} {{AUTHOR}} {{PROJECT_NAME}}
   - .devcontainer/devcontainer.json: {{AUTHOR_EMAIL}} {{AUTHOR}} {{CURRENT_YEAR}} {{OWNER}} {{PROJECT_NAME}}
   - .envrc: {{PROJECT_NAME}}
   - .github/CODEOWNERS: {{OWNER}}
   - .github/CODE_OF_CONDUCT.md: {{CONDUCT_EMAIL}} {{CONDUCT_TEAM}} {{CURRENT_YEAR}} {{RESPONSE_TIME}}
   - .github/CONTRIBUTING.md: {{MAIN_BRANCH}}
   - .github/GOVERNANCE.md: {{CURRENT_YEAR}} {{OWNER}} {{PROJECT_NAME}}
   - .github/ISSUE_TEMPLATE/config.yml: {{FORGE}} {{OWNER}} {{REPO}}
   - .github/SECURITY.md: {{CURRENT_YEAR}} {{SECURITY_EMAIL}}
   - .github/SUPPORT.md: {{OWNER}} {{REPO}}
   - .github/copilot-instructions.md: {{AUTHOR_EMAIL}} {{AUTHOR}} {{CURRENT_YEAR}} {{OWNER}}
   - .machine_readable/ENSAID_CONFIG.a2ml: {{AUTHOR_EMAIL}} {{AUTHOR}} {{CURRENT_YEAR}} {{OWNER}} {{PROJECT_NAME}}
   - .machine_readable/bot_directives/coverage.a2ml: {{AUTHOR_EMAIL}} {{AUTHOR}} {{CURRENT_DATE}} {{CURRENT_YEAR}} {{OWNER}}
   - .machine_readable/bot_directives/debt.a2ml: {{AUTHOR_EMAIL}} {{AUTHOR}} {{CURRENT_DATE}} {{CURRENT_YEAR}} {{OWNER}}
   - .machine_readable/bot_directives/methodology.a2ml: {{AUTHOR_EMAIL}} {{AUTHOR}} {{CURRENT_DATE}} {{CURRENT_YEAR}} {{OWNER}} {{PROJECT_UNIQUE_STRENGTH}} {{PROJECT}}
   - .machine_readable/coaptation/witness-map.ncl: {{PROJECT_NAME}}
   - .machine_readable/compliance/reuse/dep5: {{AUTHOR_EMAIL}} {{AUTHOR}} {{CURRENT_YEAR}} {{OWNER}} {{PROJECT_NAME}} {{REPO}}
   - .machine_readable/configs/eclexiaiser.toml: {{REPO}}
   - .machine_...

GitHub Actions: Governance / 3_governance _ Actions lockfile verify.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at the explicit helper pin failed?)"�[0m

GitHub Actions: Governance / governance _ Actions lockfile verify: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SRC=scripts�[0m
 �[36;1m  echo "Using this repository's own gate + verifier (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SRC=.standards-lock/scripts�[0m
 �[36;1mfi�[0m
 �[36;1mfor f in check-actions-lock-gate.sh update-actions-lock.sh; do�[0m
 �[36;1m  if [ ! -f "$SRC/$f" ]; then�[0m
 �[36;1m    echo "::error::actions-lock gate: $f not found in $SRC (standards checkout at the explicit helper pin failed?)"�[0m

GitHub Actions: Governance / 7_governance _ Well-Known (RFC 9116 + RSR).txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m

GitHub Actions: Governance / 8_governance _ Workflow security linter.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run if [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-workflows-parse.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/tools/policy/check-workflows-parse.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::workflow parser gate not found in the pinned Standards revision or locally"�[0m

GitHub Actions: Governance / governance _ Workflow security linter: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run # GitHub Actions REJECTS a workflow with duplicate keys: the run is
 �[36;1m# GitHub Actions REJECTS a workflow with duplicate keys: the run is�[0m
 �[36;1m# `failure` with no jobs, no log and no check run. Nothing else here�[0m
 �[36;1m# can see it, because yaml.safe_load silently keeps the LAST�[0m
 �[36;1m# duplicate and reports success — so the file "parses" and every�[0m
 �[36;1m# other lint passes. Measured 2026-08-05: nine workflows in hypatia�[0m
 �[36;1m# were dead this way, including a CodeQL workflow with zero�[0m
 �[36;1m# successful runs in its entire lifetime.�[0m
 �[36;1mset -euo pipefail�[0m
 �[36;1m# Standards exercises its pull-request scripts; every consumer uses�[0m
 �[36;1m# the canonical scripts fetched from this workflow's immutable�[0m
 �[36;1m# Standards revision.�[0m
 �[36;1mif [ "$GITHUB_REPOSITORY" = hyperpolymath/standards ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-lint)."�[0m
 �[36;1melse�[0m
 �[36;1m  SCRIPT=".standards-dupkey/scripts/check-workflow-duplicate-keys.sh"�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::duplicate-key checker not found — neither fetched from" \�[0m

GitHub Actions: Governance / 11_governance _ Security policy checks.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run FAILED=false
 �[36;1mFAILED=false�[0m
 �[36;1mWEAK_CRYPTO=$(grep -rE 'md5\(|sha1\(' --include="*.py" --include="*.rb" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" . 2>/dev/null | grep -v 'checksum\|cache\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$WEAK_CRYPTO" ]; then�[0m
 �[36;1m  echo "::warning::Weak crypto (MD5/SHA1) detected — ADVISORY, does not fail this job. Use SHA256+:"�[0m
 �[36;1m  echo "$WEAK_CRYPTO"�[0m
 �[36;1mfi�[0m
 �[36;1mHTTP_URLS=$(grep -rE 'http://[^l][^o][^c]' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.yaml" --include="*.yml" . 2>/dev/null | grep -v 'localhost\|127.0.0.1\|example\|test\|spec' | head -5 || true)�[0m
 �[36;1mif [ -n "$HTTP_URLS" ]; then�[0m
 �[36;1m  echo "::warning::HTTP URLs found — ADVISORY, does not fail this job. Use HTTPS:"�[0m
 �[36;1m  echo "$HTTP_URLS"�[0m
 �[36;1mfi�[0m
 �[36;1mSECRETS=$(grep -rEi '(api_key|apikey|secret_key|password)\s*[=:]\s*["\x27][A-Za-z0-9+/=]{20,}' --include="*.py" --include="*.js" --include="*.ts" --include="*.go" --include="*.rs" --include="*.env" . 2>/dev/null | grep -v 'example\|sample\|test\|mock\|placeholder' | head -3 || true)�[0m
 �[36;1mif [ -n "$SECRETS" ]; then�[0m
 �[36;1m  echo "::error::Potential hardcoded secrets detected — this FAILS the job:"�[0m

GitHub Actions: Governance / governance _ Security policy checks: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / 14_governance _ Language _ package anti-pattern policy.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"
 �[36;1mSCRIPT=".standards-checkout/scripts/check-ts-allowlist.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ "$GITHUB_REPOSITORY" = "hyperpolymath/standards" ] \�[0m
 �[36;1m   && [ -f scripts/check-ts-allowlist.sh ]; then�[0m
 �[36;1m  SCRIPT="scripts/check-ts-allowlist.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::check-ts-allowlist gate not found in standards@main or locally"�[0m

GitHub Actions: Governance / governance _ Language _ package anti-pattern policy: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"
 �[36;1mSCRIPT=".standards-checkout/tools/policy/check-language-policy.sh"�[0m
 �[36;1mif [ ! -f "$SCRIPT" ] && [ -f tools/policy/check-language-policy.sh ]; then�[0m
 �[36;1m  SCRIPT="tools/policy/check-language-policy.sh"�[0m
 �[36;1m  echo "Using this repository's own copy (standards self-check)."�[0m
 �[36;1mfi�[0m
 �[36;1mif [ ! -f "$SCRIPT" ]; then�[0m
 �[36;1m  echo "::error::language-policy gate not found in standards@main or locally"�[0m
🔇 Additional comments (2)
.github/CONTRIBUTING.md (1)

105-120: LGTM!

CONTRIBUTING.adoc (1)

124-139: LGTM!

📝 Summary

Summary by CodeRabbit

  • Documentation
    • Updated contribution guidance to require signed commits on the default branch and explain the signing requirements for people, interactive agents, apps, bots and workflows.
    • Clarified that unsigned commits on a pull request branch prevent merging, and that pull requests should be squash-merged; rebase merging is unavailable.

Walkthrough

Both contributor guides now document signed-commit requirements, signing methods for people and automated contributors, and related pull request merge instructions.

Changes

Signed-commit contributor guidance

Layer / File(s) Summary
Document signed-commit workflow
.github/CONTRIBUTING.md, CONTRIBUTING.adoc		 Both guides explain signing requirements, commit creation methods, and merge constraints for pull requests.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Other

Suggested reviewers: {{owner}}

Merge Risk: ⚪ Minimal · up to 3cce5

The signing guidance matches the repository’s active signature checks. Rebase availability remains unconfirmed in the live settings; no concrete merge-blocking issue is established.

Security Architecture Review

Security architecture risk: 🔵 Low · up to 3cce5

This changes contributor guidance, not enforcement or privileges. No new bypass is established, but effective signing enforcement and merge restrictions remain insufficiently verified to treat the documented guarantees as confirmed.

Retained concerns
No architecture-level concerns identified.

Security review details

Security Blast Radius

  • inferred — The identified policy boundary is acceptance of contributor commits into this repository’s default-branch source history. The inspected change does not expand that boundary through new service callers, execution paths, or granted authority.

Trust Boundaries and Controls

  • inferred — The guides’ unconditional signing assurance and statement that rebase merging is disabled cannot be validated from repository files alone. The settings permit rebase, while the ruleset payload specifies squash-only merging; effective behavior depends on deployed controls. This uncertainty does not establish an unsigned-commit attack path.

Hardening Proposals

  • proposed — Validate active default-branch rules, signing-bypass semantics, and repository merge settings before relying on universal signing and squash-only assurances. This is control-assurance work, not remediation of a demonstrated bypass.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly identifies the documentation change and matches the main purpose of the pull request.
Description check ✅ Passed The description clearly explains the purpose, policy context, main changes, and docs-only scope. It does not include the template sections for the quality checklist, testing, or screenshots, but these…
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit checks each commit with care,
Signed SSH keys hop through the air.
Squash-merged branches cross the gate,
Unsigned commits must recreate.
The guide now shows the signing way.

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath merged commit be82922 into main Oct 1, 2026
52 of 57 checks passed
@hyperpolymath
hyperpolymath deleted the docs/signing-policy-d218 branch October 1, 2026 19:47
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@coderabbitai coderabbitai[bot] coderabbitai[bot] approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@hyperpolymath