[turnipdabeets]

Problem

main requires signed commits, but nothing in this repo's contributor docs says so. Contributors, especially first-timers and agent-driven ones, keep opening PRs with unsigned commits. Maintainers then have to ask for re-signing or re-sign the commits themselves before merging. Example: #5353, #5355 and #5393 from the same contributor. They signed one commit by hand after being asked, but their next commits were unsigned again because signing isn't on in their git config.

posthog-python already has a "Commit signing" section in its CONTRIBUTING.md. This PR brings the same section to posthog-js.

Changes

• CONTRIBUTING.md: new "Commit signing" section linking to the handbook guide. It tells contributors to set commit.gpgsign to true so signing persists.
• AGENTS.md: one line telling agents to sign every commit in the git config they commit with.
• PR template: an "All commits are signed" checklist item.

Docs only, so there's no changeset.

Release info Sub-libraries affected

Libraries affected

• All of them
• posthog-js (web)
• posthog-js-lite (web lite)
• posthog-node
• posthog-react-native
• @posthog/react-native-plugin
• @posthog/react
• @posthog/ai
• @posthog/convex
• @posthog/next
• @posthog/nextjs-config
• @posthog/nuxt
• @posthog/openfeature-node-provider
• @posthog/openfeature-web-provider
• @posthog/rollup-plugin
• @posthog/webpack-plugin
• @posthog/types
• @posthog/browser-common

Checklist

• All commits are signed (see Commit signing)
• Tests for new code
• Accounted for the impact of any changes across different platforms
• Accounted for backwards compatibility of any changes (no breaking changes!)
• Took care not to unnecessarily increase the bundle size

If releasing new changes

• Ran pnpm changeset to generate a changeset file

Test plan

• oxfmt --check passes on the three changed files.
• Checked that the handbook anchor #commit-signing exists.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Claude Code (Opus) drafted this while looking into why a contributor's PRs kept arriving unsigned. The wording mirrors posthog-python's existing section. The plan is to port the same change to the other SDK repos once this one is agreed. A CI check that fails unsigned fork PRs early was considered, but it's left for a separate change.

🤖 Generated with Claude Code

[github-actions]

📝 No Changeset Found

This PR doesn't include a changeset. A changeset is required to release a new version.

How to add a changeset

Run this command and follow the prompts:

pnpm changeset

Remember: Never use major version bumps for posthog-js as it's autoloaded by clients.

[github-actions]

Coherence

4 spec problems · 0 failing chokepoints · 2 spec gaps · 0 guard failures

44 components, 7 bullets (5 invariants, 2 requirements), 4 problems

Spec problems (spec --check)

• packages/ai/src/otel/Otel.spec.md:7 an invariant bullet starts with <name>: <sentence>
• packages/ai/src/otel/Otel.spec.md:8 an invariant bullet starts with <name>: <sentence>
• Posthog-js.practice.md:20 practice add an invariant cites 187a5c5, which is no commit in this repository
• Posthog-js.practice.md:20 practice add an invariant cites 8922ab2, which is no commit in this repository

Chokepoints: none declared.

Spec gaps: 2 entrances with outside or unknown trust and no traced control, and 10 more held by the adoption baseline

• packages/web/Web.spec.md entrance public api (trust host-app): packages/web
• packages/webpack-plugin/Webpack-plugin.spec.md entrance webpack plugin (trust build): packages/webpack-plugin

Close one with guard: <chokepoint>, an invariant that names it on its entrances: line, or control: none — <reason>; scaffold control proposes it.