Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

Document commit signing: rationale, setup, and org-wide enforcement

オープン
  • 何か問題がありますか？
#12 コメント 0 件 リアクション 0 件 担当者 1 名 GitHub で見る

@Ethan-Arrowood がすでに取り組んでいます。

2026年7月10日 から。

評価

この issue はまだ評価されていません。

説明

Summary

Write a commit signing guideline doc. We want to enforce commit signing across the org — all commits to all HarperFast repos, with public-facing OSS repos as the highest priority, should be signed.

Doc outline

The doc should be structured in this order:

1. Why commit signing matters

Open with the rationale: signed commits cryptographically verify that a commit actually came from the person it claims to be from. Cover the threat model briefly — author spoofing (anyone can set user.name/user.email to anything), supply chain integrity for our OSS consumers, and the "Verified" badge as a trust signal on public repos.

2. How to set it up

Link out to setup resources rather than duplicating them:

3. How we enforce it

Link to the enforcement mechanisms and document which ones we use:

  • Org-level: rulesets at the organization level with the "Require signed commits" rule
  • Repo-level: branch protection / repo rulesets requiring signed commits on default branches
  • Document the actual settings we apply so repo admins can verify their repo is compliant
4. AI agent workflows

Platform enforcement (rulesets, CI, hooks) is the backstop, but AI agents are a major producer of commits and a major reviewer of PRs — the guideline should be embedded in agent workflows too, especially in the window before hard enforcement is rolled out:

  • Producing commits: skills / agent instructions (e.g. in the skills repo, CLAUDE.md/AGENTS.md conventions) should instruct agents that commits they author must be signed — verify the environment's signing config (git config commit.gpgsign, signing key present) before committing, and surface a warning rather than silently producing unsigned commits.
  • Reviewing PRs: PR-review skills should include a commit check step — flag unsigned/unverified commits in review output. This gives us soft enforcement via agent review before org rulesets are turned on.

The doc should note this pattern; actually updating the individual skills can be follow-up work.

5. Effective date

Short closing section: this policy was adopted in July 2026. Enforcement applies to commits from this point onward — historical unsigned commits are grandfathered in and do not need to be rewritten. Only new commits are required to pass signature verification.

Acceptance criteria

  • Doc added to this repo following the sections above
  • Enforcement settings (org ruleset and/or repo-level guidance) documented
  • AI agent workflow guidance included (agents sign their commits; review skills check for signatures)
  • Effective date (July 2026, forward-looking only) stated
主要言語
JavaScript
スター
3
フォーク
0
30日以内にマージされた PR はありません

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

HarperFast/code-guidelines のほかの issue

HarperFast/code-guidelines の issue をすべて見る

似ている issue

JavaScript の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。