feat(git): add pre-push hook to reject unsigned commits #148

Merged

rootiest merged 2 commits from chore/pre-push-signature-check into main

2026-09-13 00:58:16 +00:00

Author	SHA1	Message	Date
rootiest	6c35dc4337	docs(contributing): document the pre-push signature hook opt-in Contributors need to know .githooks/pre-push exists and how to point their clone at it, since it isn't wired up automatically.	2026-09-12 20:56:48 -04:00
rootiest	35f024c159	feat(git): add pre-push hook to reject unsigned commits Gittyup commits via libgit2 directly and never invokes gpg, silently ignoring commit.gpgsign — root cause of an unsigned commit reaching main. Adds a tracked .githooks/pre-push that rejects any push carrying a commit with no signature or a bad signature, bypassable with --no-verify. Wiring core.hooksPath to it is a per-machine concern, done separately in user-dots, not shipped here.	2026-09-12 20:51:19 -04:00

Author

SHA1

Message

Date

rootiest

6c35dc4337

docs(contributing): document the pre-push signature hook opt-in

Contributors need to know .githooks/pre-push exists and how to point
their clone at it, since it isn't wired up automatically.

2026-09-12 20:56:48 -04:00

rootiest

35f024c159

feat(git): add pre-push hook to reject unsigned commits

Gittyup commits via libgit2 directly and never invokes gpg, silently
ignoring commit.gpgsign — root cause of an unsigned commit reaching
main. Adds a tracked .githooks/pre-push that rejects any push
carrying a commit with no signature or a bad signature, bypassable
with --no-verify. Wiring core.hooksPath to it is a per-machine
concern, done separately in user-dots, not shipped here.

2026-09-12 20:51:19 -04:00