Repository navigation
docs: require signed commits, rename CONTRIBUTE.md to CONTRIBUTING.md - #880
Merged
Merged
Conversation
Two changes to the contributor guidelines: 1. Add a "Signing Your Commits" section. All commits in a PR must be cryptographically signed. Covers SSH and GPG setup, the GitHub key-type and email-matching gotchas that produce an Unverified badge, and how to retroactively sign commits that were already pushed. 2. Rename the file to CONTRIBUTING.md. GitHub only surfaces the "Contributing guidelines" prompt on new issues and PRs for that exact filename, so third-party contributors were never shown this document — which is a large part of why unsigned PRs arrive. Inbound links in README.md, packages/stack/README.md, and the target list in scripts/lint-no-dead-package-paths.mjs updated to match.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
A third-party PR landed recently with unsigned commits. Two reasons that happened, and this fixes both.
1. The guidelines never said signing was required
Adds a Signing Your Commits section to the contributor guidelines, plus a step in "Making Changes" pointing at it. It covers:
git rebase --exec 'git commit --amend --no-edit -S' main+--force-with-lease), with a warning to only force-push your own PR branch.2. Contributors were probably never shown the file
The file was named
CONTRIBUTE.md. GitHub only surfaces its "Contributing guidelines" prompt on new issues and PRs forCONTRIBUTING.md(in the repo root,.github/, ordocs/), so the document was effectively invisible to drive-by contributors.Renamed to
CONTRIBUTING.mdand updated the inbound references:README.mdpackages/stack/README.mdscripts/lint-no-dead-package-paths.mjsnode scripts/lint-no-dead-package-paths.mjspasses;biome checkclean on the touched files.Closes #881.