docs(dx): document GPG signing requirement for commits by manishdixitlfx · Pull Request #674 · linuxfoundation/lfx-self-serve

manishdixitlfx · 2026-05-11T17:42:11Z

Surfaced during PR #672 review: @jordane confirmed GPG signing is
enforced by repo policy, but neither CLAUDE.md nor
.claude/rules/commit-workflow.md mentioned it. Both said only DCO
sign-off was required, which caused churn during that review.

CLAUDE.md: updated the single-line commit guidance to git commit --signoff -S and noted both signatures are enforced.
.claude/rules/commit-workflow.md: added a "Commit Signing" section
with one-time GPG setup, the standard commit command, and a
signature-verification snippet for branch validation.

Signed-off-by: Manish Dixit mdixit@linuxfoundation.org

@jordane

Surfaced during PR #672 review: @jordane confirmed GPG signing is enforced by repo policy, but neither CLAUDE.md nor .claude/rules/commit-workflow.md mentioned it. Both said only DCO sign-off was required, which caused churn during that review. - CLAUDE.md: updated the single-line commit guidance to `git commit --signoff -S` and noted both signatures are enforced. - .claude/rules/commit-workflow.md: added a "Commit Signing" section with one-time GPG setup, the standard commit command, and a signature-verification snippet for branch validation. Signed-off-by: Manish Dixit <mdixit@linuxfoundation.org>

claude

Claude Code Review

This repository is configured for manual code reviews. Comment @claude review to trigger a review and subscribe this PR to future pushes, or @claude review once for a one-time review.

_{Tip: disable this comment in your organization's Code Review settings.}

coderabbitai · 2026-05-11T17:42:44Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f284972e-517a-4f4a-a46c-cc92bd69321f

📥 Commits

Reviewing files that changed from the base of the PR and between ba274ec and 4ed1730.

📒 Files selected for processing (3)

.claude/agents/code-standards-enforcer.md
.claude/rules/commit-workflow.md
CONTRIBUTING.md

✅ Files skipped from review due to trivial changes (1)

.claude/rules/commit-workflow.md

Walkthrough

This PR updates developer workflow documentation and an enforcer rule to require every commit to include both a DCO sign-off (--signoff) and a GPG signature (-S), adds GPG configuration and verification instructions, and updates example commit commands accordingly.

Changes

Commit Signing Policy

Layer / File(s)	Summary
Detailed Signing Requirements `.claude/rules/commit-workflow.md`	Adds "Commit Signing" section specifying DCO sign-off (`--signoff`), GPG signing (`-S`), configuration commands for `user.signingkey` and `commit.gpgsign`, canonical signed commit command, and `git log` verification with `%G?` codes.
Enforcer Rule Update `.claude/agents/code-standards-enforcer.md`	Updates the enforcer's "General Rules" to require `--signoff -S` and reference the `.claude/rules/commit-workflow.md` policy.
Developer Instruction Update `CLAUDE.md`	Changes the commit instruction from `git commit --signoff` to `git commit --signoff -S` and references the commit-workflow rule file.
CONTRIBUTING Guidance `CONTRIBUTING.md`	Replaces standalone "Sign-off" instructions with "Sign-off and GPG Signing", specifies `git commit --signoff -S`, explains DCO and GPG behaviors, and links to the canonical workflow file.

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately summarizes the main change: documentation updates to communicate GPG signing requirements for commits.
Description check	✅ Passed	The description is directly related to the changeset, explaining the trigger (undocumented GPG requirement discovered during PR `#672`), the specific files modified, and what changes were made.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch docs/gpg-enforcement

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

Copilot

Pull request overview

Updates contributor documentation to reflect repository-enforced commit signing requirements (both DCO sign-off and GPG commit signatures), reducing friction during PR reviews and CI validation.

Changes:

Update CLAUDE.md commit guidance to require git commit --signoff -S.
Add a “Commit Signing” section to .claude/rules/commit-workflow.md with GPG setup steps, standard commit command, and a signature-check snippet.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`CLAUDE.md`	Updates the commit guidance line to reflect both DCO and GPG signing requirements.
`.claude/rules/commit-workflow.md`	Adds explicit commit signing setup and verification guidance for contributors.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Address review comments from @copilot-pull-request-reviewer: - Step 4 hard checks: replaced the manual prose Signed-off-by check with a single combined verification command that asserts both GPG signature status (`%G?`) and trailer presence per commit via `git log --format='%G? %(trailers:key=Signed-off-by,valueonly...)'` — fail-fast block is now fully actionable rather than partly manual (per @copilot-pull-request-reviewer on line 75) - Step 6 gh pr create: dropped the branch-name fallback for PR title and clarified the title must be `type(scope): description`, lowercase, no JIRA ticket. If the first commit subject doesn't satisfy that, command asks user for a valid title. Prevents PR-title-lint CI failures from branch-name fallbacks like `feat/LFXV2-1697` (per @copilot-pull-request-reviewer on line 124) - Step 6 PR-body checklist: `yarn lint` -> `yarn lint:check`, added `yarn format:check` line, so checklist labels now match the gates actually run in Step 3 (per @copilot-pull-request-reviewer on line 112) Item 4 (false positive on GPG mandate, line 50) is being handled by companion PR #674 which documents the GPG-enforcement policy in CLAUDE.md and .claude/rules/commit-workflow.md. Item 5 (draft-mode contradiction at line 13) deferred pending user direction on whether to implement --draft end-to-end or remove the draft references from $ARGUMENTS interpretation. Resolves 3 of 5 review threads; 1 reply-only (false positive); 1 deferred. Signed-off-by: Manish Dixit <mdixit@linuxfoundation.org>

@jordane

Address PR #674 review feedback from @copilot-pull-request-reviewer and @jordane. - CONTRIBUTING.md (Sign-off section): renamed to "Sign-off and GPG Signing", expanded to require both --signoff and -S, included one-time GPG config, and pointed at .claude/rules/commit-workflow.md as the canonical policy source (per @copilot-pull-request-reviewer) - .claude/agents/code-standards-enforcer.md (General Rules checklist): updated the commit-signing item to require both --signoff and -S with a cross-reference to commit-workflow.md (per @copilot-pull-request-reviewer) - .claude/rules/commit-workflow.md (verification snippet): relaxed acceptable %G? codes to G or U (good-but-untrusted is fine for policy), documented that N/B/E need investigation, and noted that GitHub's Verified badge is the authoritative post-push check since local %G? depends on which keys are in the user's trust db (per @copilot-pull-request-reviewer and @jordane) Resolves 2 review threads. Signed-off-by: Manish Dixit <mdixit@linuxfoundation.org>

manishdixitlfx · 2026-05-11T21:32:21Z

Review Feedback Addressed

Commit: 4ed1730

Changes Made

CONTRIBUTING.md ("Sign-off" section): renamed to "Sign-off and GPG Signing"; command updated to git commit --signoff -S; one-time GPG config added; cross-referenced .claude/rules/commit-workflow.md as canonical source (per @copilot-pull-request-reviewer)
.claude/agents/code-standards-enforcer.md (General Rules checklist): updated commit-signing item from --signoff to --signoff -S with cross-reference to commit-workflow.md (per @copilot-pull-request-reviewer)
.claude/rules/commit-workflow.md (verification snippet): relaxed acceptable %G? codes to G or U (good-but-untrusted is fine for policy); documented that N / B / E need investigation; noted that GitHub's Verified badge is the authoritative post-push check since local %G? depends on the user's trust db (per @copilot-pull-request-reviewer and @jordane)

Threads Resolved

2 of 2 unresolved threads addressed.

Follow-up Note

The /lfx-pr slash command in PR #672 (.claude/commands/lfx-pr.md) has the same %G? verification snippet with the strict "must be G" requirement. It should mirror the relaxation made here (accept G or U). Will push a follow-up commit on feat/lfx-pr-command after this PR is reviewed.

Copilot · 2026-05-11T21:32:30Z

@manishdixitlfx I've opened a new pull request, #681, to work on those changes. Once the pull request is ready, I'll request review from you.

Mirrors the verification-snippet relaxation from PR #674 so the /lfx-pr command and the canonical commit-workflow rule stay in sync. - Accept %G? codes G or U (good signature, with U meaning the signing key isn't in the local trust db — fine for policy purposes) - Flag N / B / E as codes needing investigation - Note that GitHub's Verified badge is the authoritative post-push check, since local %G? depends on which keys the user has imported Signed-off-by: Manish Dixit <mdixit@linuxfoundation.org>

Copilot

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Copilot AI review requested due to automatic review settings May 11, 2026 17:42

manishdixitlfx requested a review from a team as a code owner May 11, 2026 17:42

claude Bot reviewed May 11, 2026

View reviewed changes

Copilot started reviewing on behalf of manishdixitlfx May 11, 2026 17:42 View session

Copilot AI reviewed May 11, 2026

View reviewed changes

Comment thread .claude/rules/commit-workflow.md

Comment thread .claude/rules/commit-workflow.md Outdated

manishdixitlfx mentioned this pull request May 11, 2026

feat(dx): add /lfx-pr slash command for PR shipping #672

Open

Copilot AI mentioned this pull request May 11, 2026

docs(dx): document GPG signing requirement for commits #681

Draft

Merge branch 'main' into docs/gpg-enforcement

ecc39ce

Copilot AI review requested due to automatic review settings May 12, 2026 19:30

dealako approved these changes May 12, 2026

View reviewed changes

Copilot started reviewing on behalf of dealako May 12, 2026 19:31 View session

dealako merged commit efc8f5f into main May 12, 2026
12 checks passed

dealako deleted the docs/gpg-enforcement branch May 12, 2026 19:31

Copilot AI reviewed May 12, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

docs(dx): document GPG signing requirement for commits#674

docs(dx): document GPG signing requirement for commits#674
dealako merged 3 commits into
mainfrom
docs/gpg-enforcement

manishdixitlfx commented May 11, 2026

Uh oh!

claude Bot left a comment

Uh oh!

coderabbitai Bot commented May 11, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

manishdixitlfx commented May 11, 2026

Uh oh!

Copilot AI commented May 11, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

manishdixitlfx commented May 11, 2026

Uh oh!

claude Bot left a comment

Choose a reason for hiding this comment

Claude Code Review

Uh oh!

coderabbitai Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

manishdixitlfx commented May 11, 2026

Review Feedback Addressed

Changes Made

Threads Resolved

Follow-up Note

Uh oh!

Copilot AI commented May 11, 2026

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

coderabbitai Bot commented May 11, 2026 •

edited

Loading