Skip to content

docs: add Signed commits section to CONTRIBUTING - #263

Merged
hyperpolymath merged 1 commit into
mainfrom
docs/signing-policy-d218
Oct 1, 2026
Merged

hyperpolymath merged 1 commit into
mainfrom
docs/signing-policy-d218

Conversation

@hyperpolymath

Copy link
Copy Markdown
Owner

Adds a Signed commits section to this repo's CONTRIBUTING, per owner ruling D218. The estate policy is docs/SIGNING-POLICY.adoc in hyperpolymath/standards.

This repo's default branch is covered by the zero-bypass Require-Signed-Commits ruleset, and rebase-merge is off. The section tells contributors what that requires:

  • People and interactive agents sign with an SSH signing key.
  • Apps, bots and workflows write through the API, so GitHub signs their commits.
  • PRs are merged with squash.

If the file already had its own signing section, that section is replaced in place instead of adding a second one. Lines elsewhere that told people to sign with GPG are changed to match the policy (SSH for people).

This is a docs-only change. The commit was created through createCommitOnBranch, so GitHub signs it.

🤖 Generated with Claude Code

https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f

Owner ruling D218. See docs/SIGNING-POLICY.adoc in hyperpolymath/standards.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01WRvDivYwLSeVCJUrfjic3f
@coderabbitai

coderabbitai Bot commented Oct 1, 2026 •

Copy link
Copy Markdown

Review in Change Stack →

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: 86e7d462-f0e9-41ae-8938-405b49202b6b

📥 Commits

Reviewing files that changed from the base of the PR and between e6d52b4 and e0b772f.

📒 Files selected for processing (3)
  • .github/CONTRIBUTING.md
  • CONTRIBUTING.adoc
  • CONTRIBUTING.md

Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review.

📜 Recent review details
⏰ Context from checks skipped due to timeout. (25)
  • GitHub Check: governance / Code quality + docs
  • GitHub Check: governance / Workflow security linter
  • GitHub Check: governance / Guix primary / Nix fallback policy
  • GitHub Check: governance / Check Workflow Staleness
  • GitHub Check: governance / Trusted-base reduction policy
  • GitHub Check: governance / Licence consistency
  • GitHub Check: governance / Well-Known (RFC 9116 + RSR)
  • GitHub Check: governance / Security policy checks
  • GitHub Check: governance / Language / package anti-pattern policy
  • GitHub Check: scan / shell-secrets
  • GitHub Check: scan / rust-secrets
  • GitHub Check: scan / gitleaks
  • GitHub Check: hypatia / Hypatia Neurosymbolic Analysis
  • GitHub Check: Hypatia neurosymbolic scan
  • GitHub Check: Patch Bridge CVE triage
  • GitHub Check: panic-attack assail
  • GitHub Check: Empty-linter (invisible characters)
  • GitHub Check: Layering contract (I1 + I3)
  • GitHub Check: Cargo audit (RustSec advisories)
  • GitHub Check: Validate K9 contracts
  • GitHub Check: Validate DEED manifests
  • GitHub Check: Smoke test (Node.js AffineScript parser)
  • GitHub Check: Structural E2E (no-build)
  • GitHub Check: Build + E2E (Idris2 + Zig)
  • GitHub Check: Cargo build + test (typed-wasm-verify)
⚠️ CI failures not shown inline (17)

GitHub Actions: E2E Validation / 0_Structural E2E (no-build).txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run E2E_BUILD=0 bash tests/e2e.sh
 �[36;1mE2E_BUILD=0 bash tests/e2e.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0;36m=== 1. Spec documents ===�[0m
   �[0;32mPASS�[0m  Level spec document exists and is non-trivial (32177 bytes)
   �[0;31mFAIL�[0m  Missing: LEVEL-STATUS.md
   �[0;32mPASS�[0m  Grammar spec exists (32596 bytes)
 �[0;36m=== 2. Example .twasm files (levels 1-6) ===�[0m
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/01-single-module.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/02-multi-module.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/03-ownership-linearity.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/04-ecs-game.twasm
   �[0;32mPASS�[0m  examples/ contains 6 .twasm files (>= 4)
 �[0;36m=== 3. Idris2 ABI files (L1-L10) ===�[0m
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Region.idr (23565 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/TypedAccess.idr (10290 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Pointer.idr (9325 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Levels.idr (14774 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Effects.idr (14156 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Lifetime.idr (11447 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Linear.idr (12956 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Proofs.idr (65715 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/MultiModule.idr (25185 bytes)
   �[0;32mPASS�[0m  Draft Idris2 file exists (L11/L12): src/abi/TypedWasm/ABI/Tropical.idr
   �[0;32mPASS�[0m  Draft Idris2 file exists (L11/L12): src/abi/TypedWasm/ABI/Epistemic.idr
 �[0;36m=== 4. Zig FFI implementation ===�[0m
   �[0;32mPASS�[0m  Zig FFI file exists: ffi/zig/build.zig (5235...

GitHub Actions: E2E Validation / Structural E2E (no-build): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run E2E_BUILD=0 bash tests/e2e.sh
 �[36;1mE2E_BUILD=0 bash tests/e2e.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0;36m=== 1. Spec documents ===�[0m
   �[0;32mPASS�[0m  Level spec document exists and is non-trivial (32177 bytes)
   �[0;31mFAIL�[0m  Missing: LEVEL-STATUS.md
   �[0;32mPASS�[0m  Grammar spec exists (32596 bytes)
 �[0;36m=== 2. Example .twasm files (levels 1-6) ===�[0m
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/01-single-module.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/02-multi-module.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/03-ownership-linearity.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/04-ecs-game.twasm
   �[0;32mPASS�[0m  examples/ contains 6 .twasm files (>= 4)
 �[0;36m=== 3. Idris2 ABI files (L1-L10) ===�[0m
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Region.idr (23565 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/TypedAccess.idr (10290 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Pointer.idr (9325 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Levels.idr (14774 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Effects.idr (14156 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Lifetime.idr (11447 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Linear.idr (12956 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Proofs.idr (65715 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/MultiModule.idr (25185 bytes)
   �[0;32mPASS�[0m  Draft Idris2 file exists (L11/L12): src/abi/TypedWasm/ABI/Tropical.idr
   �[0;32mPASS�[0m  Draft Idris2 file exists (L11/L12): src/abi/TypedWasm/ABI/Epistemic.idr
 �[0;36m=== 4. Zig FFI implementation ===�[0m
   �[0;32mPASS�[0m  Zig FFI file exists: ffi/zig/build.zig (5235...

GitHub Actions: E2E Validation / 1_Smoke test (Node.js AffineScript parser).txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run node tests/aspect/claim-envelope.mjs
 �[36;1mnode tests/aspect/claim-envelope.mjs�[0m
 �[36;1mnode tests/aspect/security-envelope.mjs�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 === 1. ipkg membership matches doc claims ===
   OK    typed-wasm.ipkg lists 23 modules
   OK    Tropical (L11) is in typed-wasm.ipkg
   OK    Epistemic (L12) is in typed-wasm.ipkg
   OK    ROADMAP.adoc L11/L12 claims do not contradict the ipkg
   SKIP  LEVEL-STATUS.md not found — cannot cross-check L11/L12 claim
   OK    README.adoc L11/L12 claims do not contradict the ipkg
 === 2. unsound-pattern badge truthfulness ===
   OK    all 24 .idr files: 0 non-comment occurrences of banned patterns
   OK    README badge claims believe_me=0 (matches reality)
 === 3. Rust crate constants match README spec ===
   OK    OwnershipKind::Unrestricted = 0 (matches README spec)
   OK    OwnershipKind::Linear = 1 (matches README spec)
   OK    OwnershipKind::SharedBorrow = 2 (matches README spec)
   OK    OwnershipKind::ExclBorrow = 3 (matches README spec)
   OK    OWNERSHIP_SECTION_NAME = "typedwasm.ownership" (matches doc claims)
 === 4. CI + Justfile path references are real ===
   OK    Justfile -> tests/parser/ParserTests.mjs (build output; source exists)
   OK    Justfile -> tests/contracts/airborne-step-state-contract.mjs
   OK    Justfile -> tests/e2e/e2e-driver.mjs
   OK    Justfile -> tests/levels/L1.mjs
   OK    Justfile -> tests/levels/L2.mjs
   OK    Justfile -> tests/levels/L3.mjs
   OK    Justfile -> tests/levels/L4.mjs
   OK    Justfile -> tests/levels/L5.mjs
   OK    Justfile -> tests/levels/L6.mjs
   OK    Justfile -> tests/levels/L7.mjs
   OK    Justfile -> tests/levels/L8.mjs
   OK    Justfile -> tests/levels/L9.mjs
   OK    Justfile -> tests/levels/L10.mjs
   OK    Justfile -> tests/smoke/e2e-smoke.mjs
   OK    Justfile -> tests/aspect/claim-envelope.mjs
   OK    Justfile -> tests/aspect/security-envelope.mjs
   OK    Justfile -> tests/property/property_test.mjs
   O...

GitHub Actions: E2E Validation / Smoke test (Node.js AffineScript parser): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run node tests/aspect/claim-envelope.mjs
 �[36;1mnode tests/aspect/claim-envelope.mjs�[0m
 �[36;1mnode tests/aspect/security-envelope.mjs�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 === 1. ipkg membership matches doc claims ===
   OK    typed-wasm.ipkg lists 23 modules
   OK    Tropical (L11) is in typed-wasm.ipkg
   OK    Epistemic (L12) is in typed-wasm.ipkg
   OK    ROADMAP.adoc L11/L12 claims do not contradict the ipkg
   SKIP  LEVEL-STATUS.md not found — cannot cross-check L11/L12 claim
   OK    README.adoc L11/L12 claims do not contradict the ipkg
 === 2. unsound-pattern badge truthfulness ===
   OK    all 24 .idr files: 0 non-comment occurrences of banned patterns
   OK    README badge claims believe_me=0 (matches reality)
 === 3. Rust crate constants match README spec ===
   OK    OwnershipKind::Unrestricted = 0 (matches README spec)
   OK    OwnershipKind::Linear = 1 (matches README spec)
   OK    OwnershipKind::SharedBorrow = 2 (matches README spec)
   OK    OwnershipKind::ExclBorrow = 3 (matches README spec)
   OK    OWNERSHIP_SECTION_NAME = "typedwasm.ownership" (matches doc claims)
 === 4. CI + Justfile path references are real ===
   OK    Justfile -> tests/parser/ParserTests.mjs (build output; source exists)
   OK    Justfile -> tests/contracts/airborne-step-state-contract.mjs
   OK    Justfile -> tests/e2e/e2e-driver.mjs
   OK    Justfile -> tests/levels/L1.mjs
   OK    Justfile -> tests/levels/L2.mjs
   OK    Justfile -> tests/levels/L3.mjs
   OK    Justfile -> tests/levels/L4.mjs
   OK    Justfile -> tests/levels/L5.mjs
   OK    Justfile -> tests/levels/L6.mjs
   OK    Justfile -> tests/levels/L7.mjs
   OK    Justfile -> tests/levels/L8.mjs
   OK    Justfile -> tests/levels/L9.mjs
   OK    Justfile -> tests/levels/L10.mjs
   OK    Justfile -> tests/smoke/e2e-smoke.mjs
   OK    Justfile -> tests/aspect/claim-envelope.mjs
   OK    Justfile -> tests/aspect/security-envelope.mjs
   OK    Justfile -> tests/property/property_test.mjs
   O...

GitHub Actions: E2E Validation / 2_Build + E2E (Idris2 + Zig).txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run E2E_BUILD=1 bash tests/e2e.sh
 �[36;1mE2E_BUILD=1 bash tests/e2e.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0;36m=== 1. Spec documents ===�[0m
   �[0;32mPASS�[0m  Level spec document exists and is non-trivial (32177 bytes)
   �[0;31mFAIL�[0m  Missing: LEVEL-STATUS.md
   �[0;32mPASS�[0m  Grammar spec exists (32596 bytes)
 �[0;36m=== 2. Example .twasm files (levels 1-6) ===�[0m
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/01-single-module.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/02-multi-module.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/03-ownership-linearity.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/04-ecs-game.twasm
   �[0;32mPASS�[0m  examples/ contains 6 .twasm files (>= 4)
 �[0;36m=== 3. Idris2 ABI files (L1-L10) ===�[0m
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Region.idr (23565 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/TypedAccess.idr (10290 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Pointer.idr (9325 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Levels.idr (14774 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Effects.idr (14156 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Lifetime.idr (11447 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Linear.idr (12956 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Proofs.idr (65715 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/MultiModule.idr (25185 bytes)
   �[0;32mPASS�[0m  Draft Idris2 file exists (L11/L12): src/abi/TypedWasm/ABI/Tropical.idr
   �[0;32mPASS�[0m  Draft Idris2 file exists (L11/L12): src/abi/TypedWasm/ABI/Epistemic.idr
 �[0;36m=== 4. Zig FFI implementation ===�[0m
   �[0;32mPASS�[0m  Zig FFI file exists: ffi/zig/build.zig (5235...

GitHub Actions: E2E Validation / Build + E2E (Idris2 + Zig): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run E2E_BUILD=1 bash tests/e2e.sh
 �[36;1mE2E_BUILD=1 bash tests/e2e.sh�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 �[0;36m=== 1. Spec documents ===�[0m
   �[0;32mPASS�[0m  Level spec document exists and is non-trivial (32177 bytes)
   �[0;31mFAIL�[0m  Missing: LEVEL-STATUS.md
   �[0;32mPASS�[0m  Grammar spec exists (32596 bytes)
 �[0;36m=== 2. Example .twasm files (levels 1-6) ===�[0m
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/01-single-module.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/02-multi-module.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/03-ownership-linearity.twasm
   �[0;32mPASS�[0m  Example file exists and is non-empty: examples/04-ecs-game.twasm
   �[0;32mPASS�[0m  examples/ contains 6 .twasm files (>= 4)
 �[0;36m=== 3. Idris2 ABI files (L1-L10) ===�[0m
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Region.idr (23565 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/TypedAccess.idr (10290 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Pointer.idr (9325 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Levels.idr (14774 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Effects.idr (14156 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Lifetime.idr (11447 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Linear.idr (12956 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/Proofs.idr (65715 bytes)
   �[0;32mPASS�[0m  Idris2 ABI file exists: src/abi/TypedWasm/ABI/MultiModule.idr (25185 bytes)
   �[0;32mPASS�[0m  Draft Idris2 file exists (L11/L12): src/abi/TypedWasm/ABI/Tropical.idr
   �[0;32mPASS�[0m  Draft Idris2 file exists (L11/L12): src/abi/TypedWasm/ABI/Epistemic.idr
 �[0;36m=== 4. Zig FFI implementation ===�[0m
   �[0;32mPASS�[0m  Zig FFI file exists: ffi/zig/build.zig (5235...

GitHub Actions: E2E Validation / 3_Cargo build + test (typed-wasm-verify).txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run cargo build --workspace --locked
 �[36;1mcargo build --workspace --locked�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 error: failed to parse lock file at: /home/runner/work/typed-wasm/typed-wasm/Cargo.lock
 Caused by:
   package `wasmparser` is specified twice in the lockfile
 ##[error]Process completed with exit code 101.

GitHub Actions: E2E Validation / Cargo build + test (typed-wasm-verify): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run cargo build --workspace --locked
 �[36;1mcargo build --workspace --locked�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 error: failed to parse lock file at: /home/runner/work/typed-wasm/typed-wasm/Cargo.lock
 Caused by:
   package `wasmparser` is specified twice in the lockfile
 ##[error]Process completed with exit code 101.

GitHub Actions: Governance / 2_governance _ Workflow security linter.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run failed=0
 �[36;1mfailed=0�[0m
 �[36;1mfor file in .github/workflows/*.yml .github/workflows/*.yaml; do�[0m
 �[36;1m  [ -f "$file" ] || continue�[0m
 �[36;1m  if ! head -1 "$file" | grep -q "^# SPDX-License-Identifier:"; then�[0m
 �[36;1m    echo "ERROR: $file missing SPDX header"; failed=1�[0m
 �[36;1m  fi�[0m
 �[36;1m  if ! grep -q "^permissions:" "$file"; then�[0m
 �[36;1m    echo "ERROR: $file missing top-level 'permissions:' declaration"; failed=1�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1m[ $failed -eq 1 ] && { echo "Add SPDX header + permissions:"; exit 1; }�[0m
 �[36;1mecho "All workflows have SPDX headers + permissions"�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ERROR: .github/workflows/boj-build.yml missing SPDX header
 ERROR: .github/workflows/c5-regenerate.yml missing SPDX header
 ERROR: .github/workflows/cargo-audit.yml missing SPDX header
 ERROR: .github/workflows/codeql.yml missing SPDX header
 ERROR: .github/workflows/contract-gate.yml missing SPDX header
 ERROR: .github/workflows/dogfood-gate.yml missing SPDX header
 ERROR: .github/workflows/e2e.yml missing SPDX header
 ERROR: .github/workflows/governance.yml missing SPDX header
 ERROR: .github/workflows/hypatia-scan.yml missing SPDX header
 ERROR: .github/workflows/instant-sync.yml missing SPDX header
 ERROR: .github/workflows/label-triage.yml missing SPDX header
 ERROR: .github/workflows/labels.yml missing SPDX header
 ERROR: .github/workflows/mirror.yml missing SPDX header
 ERROR: .github/workflows/pages.yml missing SPDX header
 ERROR: .github/workflows/push-email-notify.yml missing SPDX header
 ERROR: .github/workflows/release.yml missing SPDX header
 ERROR: .github/workflows/rhodibot.yml missing SPDX header
 ERROR: .github/workflows/scorecard.yml missing SPDX header
 ERROR: .github/workflows/secret-scanner.yml missing SPDX header
 ERROR: .github/workflows/static-analysis-gate.yml missing SPDX header
 Add SPDX header + permissions:
 ##[error]Process completed with exit cod...

GitHub Actions: Governance / governance _ Workflow security linter: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run failed=0
 �[36;1mfailed=0�[0m
 �[36;1mfor file in .github/workflows/*.yml .github/workflows/*.yaml; do�[0m
 �[36;1m  [ -f "$file" ] || continue�[0m
 �[36;1m  if ! head -1 "$file" | grep -q "^# SPDX-License-Identifier:"; then�[0m
 �[36;1m    echo "ERROR: $file missing SPDX header"; failed=1�[0m
 �[36;1m  fi�[0m
 �[36;1m  if ! grep -q "^permissions:" "$file"; then�[0m
 �[36;1m    echo "ERROR: $file missing top-level 'permissions:' declaration"; failed=1�[0m
 �[36;1m  fi�[0m
 �[36;1mdone�[0m
 �[36;1m[ $failed -eq 1 ] && { echo "Add SPDX header + permissions:"; exit 1; }�[0m
 �[36;1mecho "All workflows have SPDX headers + permissions"�[0m
 shell: /usr/bin/bash -e {0}
 ##[endgroup]
 ERROR: .github/workflows/boj-build.yml missing SPDX header
 ERROR: .github/workflows/c5-regenerate.yml missing SPDX header
 ERROR: .github/workflows/cargo-audit.yml missing SPDX header
 ERROR: .github/workflows/codeql.yml missing SPDX header
 ERROR: .github/workflows/contract-gate.yml missing SPDX header
 ERROR: .github/workflows/dogfood-gate.yml missing SPDX header
 ERROR: .github/workflows/e2e.yml missing SPDX header
 ERROR: .github/workflows/governance.yml missing SPDX header
 ERROR: .github/workflows/hypatia-scan.yml missing SPDX header
 ERROR: .github/workflows/instant-sync.yml missing SPDX header
 ERROR: .github/workflows/label-triage.yml missing SPDX header
 ERROR: .github/workflows/labels.yml missing SPDX header
 ERROR: .github/workflows/mirror.yml missing SPDX header
 ERROR: .github/workflows/pages.yml missing SPDX header
 ERROR: .github/workflows/push-email-notify.yml missing SPDX header
 ERROR: .github/workflows/release.yml missing SPDX header
 ERROR: .github/workflows/rhodibot.yml missing SPDX header
 ERROR: .github/workflows/scorecard.yml missing SPDX header
 ERROR: .github/workflows/secret-scanner.yml missing SPDX header
 ERROR: .github/workflows/static-analysis-gate.yml missing SPDX header
 Add SPDX header + permissions:
 ##[error]Process completed with exit cod...

GitHub Actions: Governance / 3_governance _ Code quality + docs.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / governance _ Code quality + docs: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run editorconfig-checker/action-editorconfig-checker@840e866d93b8e032123c23bac69dece044d4d84c
 with:
   github-***REDACTED_SECRET_ASSIGNMENT***
   version: latest
 ##[endgroup]
 Find 'latest' release
 ##[error]Error: The binary 'ec-linux-amd64*' not found

GitHub Actions: Governance / 5_governance _ Security policy checks.txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / governance _ Security policy checks: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run set -uo pipefail
 �[36;1mset -uo pipefail�[0m
 �[36;1mDIR=.github/canonical-references�[0m
 �[36;1mif [ ! -d "$DIR" ]; then�[0m
 �[36;1m  echo "ℹ️  [R5] no $DIR/ — skipped (repo has not opted in)"�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mif ! command -v python3 >/dev/null 2>&1; then�[0m
 �[36;1m  echo "❌ [R5] python3 missing on runner — required for YAML rule parsing"�[0m
 �[36;1m  exit 2�[0m
 �[36;1mfi�[0m
 �[36;1mpython3 - <<'PY'�[0m
 �[36;1mimport os, sys, glob, subprocess�[0m
 �[36;1mtry:�[0m
 �[36;1m    import yaml�[0m
 �[36;1mexcept ImportError:�[0m
 �[36;1m    sys.exit("❌ [R5] PyYAML not installed on runner; install python3-yaml")�[0m
 �[36;1m�[0m
 �[36;1mdir_ = ".github/canonical-references"�[0m
 �[36;1mfiles = sorted(glob.glob(f"{dir_}/*.yml") + glob.glob(f"{dir_}/*.yaml"))�[0m
 �[36;1mif not files:�[0m
 �[36;1m    print(f"ℹ️  [R5] {dir_}/ has no .yml/.yaml rules — skipped")�[0m
 �[36;1m    sys.exit(0)�[0m
 �[36;1m�[0m
 �[36;1mtotal = 0�[0m
 �[36;1mfor rf in files:�[0m
 �[36;1m    with open(rf, encoding="utf-8") as fh:�[0m
 �[36;1m        cfg = yaml.safe_load(fh)�[0m
 �[36;1m    if not isinstance(cfg, dict):�[0m
 �[36;1m        print(f"❌ [R5] {rf}: top-level must be a mapping"); total += 1; continue�[0m
 �[36;1m    rid  = cfg.get("id", os.path.basename(rf))�[0m
 �[36;1m    desc = cfg.get("description", "")�[0m
 �[36;1m    pats = cfg.get("patterns") or []�[0m
 �[36;1m    canon = cfg.get("canonical_pointer", "")�[0m
 �[36;1m    scope = (cfg.get("scope") or {})�[0m
 �[36;1m    includes = scope.get("include") or []�[0m
 �[36;1m    if not pats or not includes:�[0m
 �[36;1m        print(f"❌ [R5:{rid}] missing patterns or scope.include in {rf}")�[0m
 �[36;1m        total += 1; continue�[0m
 �[36;1m    # exclude self-references�[0m
 �[36;1m    skip = set(["CHANGELOG.md", "CHANGELOG.adoc", rf])�[0m
 �[36;1m    if canon: skip.add(canon)�[0m
 �[36;1m    rule_hits = 0�[0m
 �[36;1m    for f_ in includes:�[0m
 �[36;1m        if f_ in skip or not os...

GitHub Actions: Governance / 8_governance _ Well-Known (RFC 9116 + RSR).txt: docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run SECTXT=""
 �[36;1mSECTXT=""�[0m
 �[36;1m[ -f ".well-known/security.txt" ] && SECTXT=".well-known/security.txt"�[0m
 �[36;1m[ -f "security.txt" ] && SECTXT="security.txt"�[0m
 �[36;1mif [ -z "$SECTXT" ]; then�[0m
 �[36;1m  echo "::warning::No security.txt found."�[0m
 �[36;1m  exit 0�[0m
 �[36;1mfi�[0m
 �[36;1mgrep -q "^Contact:" "$SECTXT" || { echo "::error::Missing Contact field"; exit 1; }�[0m

GitHub Actions: Governance / governance _ Well-Known (RFC 9116 + RSR): docs: add Signed commits section to CONTRIBUTING

Conclusion: failure

View job details

##[group]Run MIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)
 �[36;1mMIXED=$(grep -rE 'src="http://|href="http://' --include="*.html" --include="*.htm" . 2>/dev/null | grep -vE 'localhost|127\.0\.0\.1|example\.com|lol/|node_modules/|third-party/|vendor/' | head -5 || true)�[0m
 �[36;1mif [ -n "$MIXED" ]; then�[0m
 �[36;1m  echo "::error::Mixed content (HTTP in HTML)"�[0m
🔇 Additional comments (1)
CONTRIBUTING.md (1)

26-26: 🔒 Security & Privacy | 🛡️ Detected with Advanced Tier

Required signed commits block the claimed rebase-merge bypass.

Although .github/settings.yml enables rebase-merge, the main branch requires signed commits. GitHub rewrites commits during rebase-merge without verifying their signatures, so the resulting commits cannot bypass the signed-commit requirement. The guide statements do not identify a security misconfiguration.

Likely an incorrect or invalid review comment.


📝 Summary

Summary by CodeRabbit

  • Documentation
    • Added contribution guidance requiring signed commits and verified committer emails for changes reaching the default branch.
    • Clarified that pull requests must be squash-merged and that unsigned commits prevent merging.

Walkthrough

The three contributor guides now document signed-commit requirements, signing and commit methods for different contributor types, and squash-merge restrictions.

Changes

Contribution guidance

Layer / File(s) Summary
Document signed-commit requirements
.github/CONTRIBUTING.md, CONTRIBUTING.adoc, CONTRIBUTING.md
The guides describe signing requirements for commits reaching the default branch, signing methods, API or signed-push methods for apps and workflows, and squash-merge restrictions. CONTRIBUTING.md also documents recreating a branch with signed commits.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

Merge Risk: ⚪ Minimal · up to e0b77

The documentation-only change has no established merge-blocking issue. The AsciiDoc markup is valid; maintainers should keep the stated merge restrictions aligned with effective repository settings.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Description check ⚠️ Warning The description explains the purpose and key changes, but it does not follow the required template. It omits the required Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections, in… Rewrite the description using the repository template. Add the required section headings, list the key changes, complete every checklist item, describe testing, and state whether screenshots or terminal output apply.
✅ Passed checks (4 passed)
Check name Status Explanation
Title check ✅ Passed The title clearly and concisely describes the main documentation change: adding a signed-commits section to CONTRIBUTING.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
Full details: Description check

Explanation

The description explains the purpose and key changes, but it does not follow the required template. It omits the required Summary, Changes, RSR Quality Checklist, Testing, and Screenshots sections, including the checklist responses.

  • Fix all pre-merge checks with AI
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
  • Commit to this branch
  • Create a new PR
  • Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.


Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

A rabbit signs each commit with care,
Then checks the branch before the merge.
The guides explain the steps to take,
While squash keeps commits in their place.
A happy hop seals the change.

Comment @coderabbitai help to get the list of available commands.

@hyperpolymath
hyperpolymath merged commit c9fbd25 into main Oct 1, 2026
30 of 35 checks passed
@hyperpolymath
hyperpolymath deleted the docs/signing-policy-d218 branch October 1, 2026 19:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant