Skip to content

docs(commit-signing): document how pull requests merge under the rule #7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
estefano-vechietti-azion wants to merge 1 commit into
base: main
Choose a base branch
from
Open

docs(commit-signing): document how pull requests merge under the rule #7

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
22 changes: 22 additions & 0 deletions docs/commit-signing.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,28 @@ merge that carries a commit without a verified signature is rejected. The rule i
Setup takes about five minutes and can reuse the SSH key you already push with.

- Commits made in the GitHub web interface (web edits, squash merges) are signed by GitHub. They need nothing.
- Commits already on a protected branch are not checked again. The rule applies to what is pushed or merged from now on.
- SSH signing needs git 2.34 or later (`git --version`).

## Merging pull requests

How a pull request can be merged into a protected branch once the rule is enforced:

| Merge method | Works? | Why |
|---|---|---|
| Squash and merge | Yes, even with unsigned commits on the branch | GitHub creates and signs the squashed commit |
| Create a merge commit | Only if every commit on the branch is signed | The branch's commits land on the protected branch as they are |
| Rebase and merge | No | Rebasing rewrites the commits and GitHub cannot sign them: `Rebase merges cannot be automatically signed by GitHub` |

Repositories that rebase to keep a linear history should squash instead: a squash merge is linear too.

`gh pr merge --squash` can refuse a pull request with unsigned commits, because the CLI reads the pull request as
blocked before asking GitHub. The merge itself is allowed: use the web interface, or the API:

```bash
gh api -X PUT repos/aziontech/<repo>/pulls/<number>/merge -f merge_method=squash
```

## 1. Have an SSH key

The key you already push with works. To check whether one exists:
Expand Down Expand Up @@ -147,5 +167,7 @@ The `reason` field from the verification command (step 4) usually names the caus
| `unsupported value for gpg.format: ssh` | git older than 2.34 | Upgrade git (`brew upgrade git`) |
| `agent refused operation`, or a passphrase prompt on every commit | Key not loaded in the ssh-agent | `ssh-add --apple-use-keychain ~/.ssh/id_ed25519` |
| Push rejected with `Commits must have verified signatures` | An unsigned commit on the branch | Sign the commits again (Special cases) |
| Merge refused with `Commits must have verified signatures` | Merge commit with unsigned commits on the branch | Squash and merge, or sign the commits again |
| Merge refused with `Rebase merges cannot be automatically signed by GitHub` | Rebase and merge on a protected branch | Squash and merge (Merging pull requests) |

Azion engineers with questions not answered here: ask `@aziontech/team-delivery-engineering`.
Loading