Wave-21 C04: commit signing policy and check by KooshaPari · Pull Request #180 · KooshaPari/SessionLedger

KooshaPari · 2026-07-14T01:17:13Z

Summary

Add ADR 0004 and docs/ops/commit-signing.md for GPG/SSH commit signing policy (maintainer 2FA explicitly out of scope).
Add scripts/commit-signing-check.ps1: machine-verifiable main-tip signature check, recent-history report, and soft-fail branch-protection checklist for OSS limits.
Wire .github/workflows/commit-signing.yml and cross-link SECURITY.md + CONTRIBUTING.md.

Test plan

pwsh -NoProfile -File scripts/commit-signing-check.ps1 -Ref main -Count 10
pwsh -NoProfile -File scripts/commit-signing-check.ps1 -BranchProtectionChecklist (soft exit on 404)
CI commit-signing workflow on PR

Made with Cursor

gemini-code-assist · 2026-07-14T01:17:16Z

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

coderabbitai · 2026-07-14T01:17:24Z

Warning

Review limit reached

@KooshaPari, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 3 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 11be3d77-7773-4b6f-bea9-f6026166c50b

📥 Commits

Reviewing files that changed from the base of the PR and between e0da1fa and 82e33e0.

📒 Files selected for processing (6)

.github/workflows/commit-signing.yml
CONTRIBUTING.md
SECURITY.md
docs/adr/0004-commit-signing-policy.md
docs/ops/commit-signing.md
scripts/commit-signing-check.ps1

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/sl-w21-c04-commit-signing

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch feat/sl-w21-c04-commit-signing

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

Document GPG/SSH commit signing expectations, add machine-verifiable main-tip check with soft branch-protection checklist for OSS enforcement limits. Co-authored-by: Cursor <cursoragent@cursor.com>

Co-authored-by: Cursor <cursoragent@cursor.com>

Conservative +4 on C04 L34 commit signing (#180), C05 L50 scheduled chaos smoke (#184), C08 L80 eval governance (#179), and C09 L81.13 help overlay (#183). C01/C02/C06/C11 hold at pillar max with evidence refresh for #185/#182/#177/#178. Co-authored-by: Cursor <cursoragent@cursor.com>

kilo-code-bot · 2026-07-14T07:05:47Z

+        if ($Output -match 'No signature') {
+            return @{ Ok = $false; Detail = "no signature" }
+        }
+        if ($Output -match 'gpg:\s+Signature made|Good signature|not certified|Can''t check signature|no public key') {


WARNING: Test-CommitVerifier regex does not match SSH signature success output

The regex Good signature requires a literal space between Good and signature, but git verify-commit for SSH signatures outputs Good "git" signature for ... with quotes around git. Valid SSH signatures will be incorrectly reported as verification failures.

Suggested change

if ($Output -match 'gpg:\s+Signature made|Good signature|not certified|Can''t check signature|no public key') {

if ($Output -match 'gpg:\s+Signature made|Good "git" signature|not certified|Can''t check signature|no public key') {

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

kilo-code-bot · 2026-07-14T07:05:47Z

+          fetch-depth: 0
+
+      - name: ensure origin/main is available on PR checkouts
+        run: git fetch --no-tags origin main


WARNING: git fetch --no-tags origin main fetches from origin, which for PRs from forks is the fork's main branch, not the upstream main

For cross-repo (fork) PRs, origin points to the fork. The script should fetch the upstream main explicitly so the tip check validates the correct branch.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

kilo-code-bot · 2026-07-14T07:05:47Z

+
+on:
+  pull_request:
+    paths:


SUGGESTION: pull_request trigger has a paths filter that limits this workflow to run only when policy files change

The ADR and runbook state the check runs on every PR and main push, but the paths filter means most PRs will skip this workflow entirely. If the intent is to verify commit signing on every PR, remove the paths filter or add a separate lightweight workflow without it.

Reply with @kilocode-bot fix it to have Kilo Code address this issue.

kilo-code-bot · 2026-07-14T07:06:00Z

Code Review Summary

Status: 2 Warnings, 1 Suggestion Found | Recommendation: Request Changes

Overview

Severity	Count
CRITICAL	0
WARNING	2
SUGGESTION	1

Issue Details (click to expand)

WARNING

File	Line	Issue
`scripts/commit-signing-check.ps1`	41	`Test-CommitVerifier` regex does not match SSH signature success output
`.github/workflows/commit-signing.yml`	43	`git fetch --no-tags origin main` fetches from wrong remote for fork PRs

SUGGESTION

File	Line	Issue
`.github/workflows/commit-signing.yml`	8	`pull_request` trigger has `paths` filter limiting workflow execution

Files Reviewed (6 files)

.github/workflows/commit-signing.yml - 2 issues
CONTRIBUTING.md - 0 issues
SECURITY.md - 0 issues
docs/adr/0004-commit-signing-policy.md - 0 issues
docs/ops/commit-signing.md - 0 issues
scripts/commit-signing-check.ps1 - 1 issue

Fix these issues in Kilo Cloud

_{Reviewed by step-3.7-flash · Input: 93.4K · Output: 14.4K · Cached: 392.2K}

KooshaPari and others added 2 commits July 13, 2026 18:45

docs(ops): Wave-21 C04 commit signing policy and CI check

91cfc59

Document GPG/SSH commit signing expectations, add machine-verifiable main-tip check with soft branch-protection checklist for OSS enforcement limits. Co-authored-by: Cursor <cursoragent@cursor.com>

fix(ci): resolve origin/main when local main is missing on PR checkouts

82e33e0

Co-authored-by: Cursor <cursoragent@cursor.com>

KooshaPari force-pushed the feat/sl-w21-c04-commit-signing branch from 02b86c5 to 82e33e0 Compare July 14, 2026 01:51

KooshaPari merged commit 1ca21b1 into main Jul 14, 2026
38 of 39 checks passed

KooshaPari deleted the feat/sl-w21-c04-commit-signing branch July 14, 2026 02:03

KooshaPari mentioned this pull request Jul 14, 2026

audit: Wave-21 reaudit after #177-#185 (333/402, 83% B) #186

Merged

2 tasks

kilo-code-bot Bot reviewed Jul 14, 2026

View reviewed changes

Navigation Menu

Wave-21 C04: commit signing policy and check - #180

Wave-21 C04: commit signing policy and check#180
KooshaPari merged 2 commits into
mainfrom
feat/sl-w21-c04-commit-signing

KooshaPari commented Jul 14, 2026

Uh oh!

gemini-code-assist Bot commented Jul 14, 2026

Uh oh!

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

Review limit reached

Uh oh!

Uh oh!

kilo-code-bot Bot Jul 14, 2026

Uh oh!

kilo-code-bot Bot Jul 14, 2026

Uh oh!

kilo-code-bot Bot Jul 14, 2026

Uh oh!

kilo-code-bot Bot commented Jul 14, 2026 •

edited

Loading

WARNING

SUGGESTION

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

	if ($Output -match 'gpg:\s+Signature made\|Good signature\|not certified\|Can''t check signature\|no public key') {
	if ($Output -match 'gpg:\s+Signature made\|Good "git" signature\|not certified\|Can''t check signature\|no public key') {

Conversation

KooshaPari commented Jul 14, 2026

Summary

Test plan

Uh oh!

gemini-code-assist Bot commented Jul 14, 2026

Uh oh!

coderabbitai Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Uh oh!

Uh oh!

kilo-code-bot Bot Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot Jul 14, 2026

Choose a reason for hiding this comment

Uh oh!

kilo-code-bot Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review Summary

Overview

WARNING

SUGGESTION

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jul 14, 2026 •

edited

Loading

kilo-code-bot Bot commented Jul 14, 2026 •

edited

Loading