chore(scripts): add sign-branch.sh ported from mono - #39
Merged
Merged
Conversation
Rebuilds a branch's commits as the caller's own, SSH-signed with their key, keeping the original author as a Co-authored-by trailer. Needed so agent-pushed commits pass the "Verify signed commit authors" check. Copied from rocicorp/mono (scripts/sign-branch.sh); only the header comment changed, to point at this repo's allowed_signers file and the org-wide signed-commit-authors workflow instead of mono's dev-release workflow. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01WoZSGU8EFbnz1chH1ofCPx
aboodman
force-pushed
the
claude/great-cray-l2ud2x
branch
from
September 18, 2026 02:09
aa7ab41 to
762b176
Compare
aboodman
enabled auto-merge
September 18, 2026 02:34
grgbkr
reviewed
Sep 18, 2026
| echo "rebuilding:" | ||
| git log --reverse --format=' %h %an %s' "$upstream..$head_sha" | ||
| echo | ||
|
|
Contributor
There was a problem hiding this comment.
Maybe add
echo "changes being signed:"
git diff --stat "$upstream" "$head_sha"
echo
So you get a bit more info about what you are signing and might catch if an unexpected file is being edited.
Contributor
|
I don't love it, but I accept it. I recognize with local agent authored prs similar rubber stamping can be done. |
grgbkr
approved these changes
Sep 18, 2026
grgbkr
reviewed
Sep 18, 2026
| # The rocicorp org requires every commit to be SSH-signed by a key in this repo's | ||
| # `.github/signing/allowed_signers`; the org-wide required workflow | ||
| # `.github/workflows/signed-commit-authors.yml` enforces it on every pull request. An | ||
| # agent-pushed commit carries a good signature made by a key that is not an allowed |
Contributor
There was a problem hiding this comment.
I dont think this is accurate, I don't think agent-pushed commits are signed.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This allows us to use cloud-based AI tools like Claude Code (cloud mode) with Rocicorp repos. This is very productive way to work because you can code from couch! (or while doing dishes).
Details
Adds
scripts/sign-branch.sh, copiedrocicorp/rindle. Idea is we can access this from all repos.The script rebuilds a branch's commits as the caller's own, SSH-signed with their key, keeping the original author as a
Co-authored-by:trailer and preserving the author date. It exists so agent-pushed commits can pass the org-wide "Verify Signed Commit Authors" check.git commit-treefrom the original tree, so the working tree and index are untouched.--yesis passed.--no-pushparks the rebuilt chain onrefs/sign-branch/<branch>for inspection.Changes from the mono copy
Only the header comment changed. It now points at this repo's
.github/signing/allowed_signersand the org-wide.github/workflows/signed-commit-authors.ymlrequired workflow, instead of mono'sdev-release.yml. The code is byte-identical.Test plan
bash -n scripts/sign-branch.shpasses.scripts/sign-branch.sh --helpprints the usage from the header.🤖 Generated with Claude Code
https://claude.ai/code/session_01WoZSGU8EFbnz1chH1ofCPx
Generated by Claude Code