Repository navigation
docs: add Signed commits section to CONTRIBUTING - #3
Conversation
Owner ruling D218. See docs/SIGNING-POLICY.adoc in hyperpolymath/standards. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (28)
|
| Layer / File(s) | Summary |
|---|---|
Document the signed-commit workflow .github/CONTRIBUTING.md, CONTRIBUTING.adoc |
Both guides describe signing requirements, API-based commits for apps and workflows, squash merging, and steps for unsigned PR branches. |
Priority: ⬇️ Low
Estimated code review effort: 1 (Trivial) | ~5 minutes
Change: Other
Suggested reviewers: {{owner}}
Merge Risk: ⚪ Minimal · up to 70549
This documentation-only change adds signed-commit contribution guidance. It does not alter runtime behavior. Maintainers may want to confirm that the live ruleset matches the documented merge rules.
Security Architecture Review
Security architecture risk: 🔵 Low · up to 70549
The changes add contribution instructions without modifying enforcement configuration. However, the stated signing and merge guarantees cannot be confirmed from the repository files alone. No exploitable bypass is established.
Retained concerns
- Low · architecture · inferred: The new contributor contract presents unsigned-commit rejection and disabled rebase merging as guarantees, but effective enforcement is unresolved. Existing settings enable rebase merging, while the checked-in ruleset restricts merging to squash and declares bypass actors. Separate deployed controls could reconcile these declarations. This is an assurance gap, not a demonstrated bypass or a PR-introduced weakening of enforcement.
Security review details
Security Blast Radius
- inferred — The evidenced scope is this repository’s default-branch commit provenance and contribution eligibility for people, interactive agents, and automation. Whether any configured privileged actor can bypass signing is unknown; the evidence does not establish a broader downstream exposure.
Security Findings and Attack Paths
- observed — The supplied security assessment retains no verified findings. Its candidate remains deferred because deployed ruleset state and effective pull-request bypass behavior are unavailable. It therefore does not establish an attacker-reachable unsigned-commit path or a PR-introduced increase in privileges.
Trust Boundaries and Controls
- observed — The documented signing responsibility differs by actor: people and interactive agents use their registered SSH signing identity, while automation delegates commit signing to GitHub through API-based creation. The guide does not grant additional credentials or repository permissions.
Hardening Proposals
- proposed — Confirm the effective default-branch rulesets, including any separate Require-Signed-Commits rule, their bypass actors, and allowed merge methods before treating the contribution guide’s guarantees as verified. Establish the signing and recovery behavior of the referenced API/action separately from the documentation.
🚥 Pre-merge checks | ✅ 4 | ❌ 1
❌ Failed checks (1 warning)
| Check name | Status | Explanation | Resolution |
|---|---|---|---|
| Description check | The description explains the purpose and main changes, but it does not use the required template sections for the RSR Quality Checklist, Testing, or Screenshots. | Add the required template sections. Complete the RSR Quality Checklist, describe validation performed, and state whether screenshots or terminal output are applicable. |
✅ Passed checks (4 passed)
| Check name | Status | Explanation |
|---|---|---|
| Title check | ✅ Passed | The title clearly identifies the documentation change and names the affected CONTRIBUTING file. |
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0… |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
- Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
- Commit to this branch
- Create a new PR
- Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Autopilot is currently an internal CodeRabbit preview.
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit signs beneath the moon,
Then checks each commit, neat and soon.
With SSH keys tucked away,
The branch takes squash upon its way.
Fresh carrots mark the merge of day.
Comment @coderabbitai help to get the list of available commands.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Adds a Signed commits section to this repo's CONTRIBUTING, per owner ruling D218. The estate policy is
docs/SIGNING-POLICY.adocin hyperpolymath/standards.This repo's default branch is covered by the zero-bypass
Require-Signed-Commitsruleset, and rebase-merge is off. The section tells contributors what that requires:If the file already had its own signing section, that section is replaced in place instead of adding a second one. Lines elsewhere that told people to sign with GPG are changed to match the policy (SSH for people).
This is a docs-only change. The commit was created through
createCommitOnBranch, so GitHub signs it.🤖 Generated with Claude Code
https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f