Conversation
Keep the hub's registry-driven apply logic and add a payload-driven, repo-agnostic check mode (rulesets/settings/security, non-zero on drift). apply also enables Dependabot security. shellcheck-clean, verified live against a release and an operational repo. The fleet now re-vendors onto the new canonical (parked in the divergence ledger).
…394) A history rewrite that re-signs commits (e.g. filter-repo for PII) must re-identify any not-yours commit's committer to the signing identity - GitHub verifies the signature against the committer, so a your-key signature over a bot/web-flow committer is unverified. Two-gate rule added to AGENTS.md + cross-ref in repo-config-carry.md.
Contributor
There was a problem hiding this comment.
Pull request overview
Promotes the develop line to main while also landing two governance/tooling updates: adding a payload-driven check mode to repo-config/configure.sh (alongside the existing apply behavior), and documenting a stricter signing/identity rule for history rewrites so signatures remain verifiable under require-signed-commits rulesets.
Changes:
- Extend
repo-config/configure.shwithapplyandchecksubcommands (defaulting toapplyfor backwards compatibility), and ensureapplyalso enables Dependabot security features whilecheckexits non-zero on drift. - Update onboarding and repo-config documentation to reflect the new
configure.sh apply+configure.sh checkflow. - Add an explicit AGENTS.md rule for history rewrites: scope rewrites to the minimum necessary commits, and re-identify rewritten non-owner commits to the signing identity before re-signing.
Reviewed changes
Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| STANDUP.md | Updates standup procedure to run configure.sh apply followed by configure.sh check. |
| spec/divergences.json | Collapses prior configure.sh divergence dispositions into a single re-vendor disposition reflecting the new canonical. |
| reports/divergences.md | Regenerates divergence report to match updated dispositions and current drift counts. |
| repo-config/README.md | Documents new configure.sh apply/check modes and Dependabot security enablement. |
| repo-config/configure.sh | Implements payload-driven check mode, keeps apply behavior as default, and enables Dependabot security features during apply. |
| docs/repo-config-carry.md | Updates carry/apply instructions to use configure.sh apply + configure.sh check, and references the new history-rewrite rule. |
| AGENTS.md | Adds a two-gate history-rewrite signing rule to prevent unverified signatures under require-signed-commits. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotes the develop line to main. Merge-commit promotion (not squash);
developis the head and is never deleted.Included (2 commits)
configure.shcanonical. Keeps the hub's registry-drivenapplylogic and adds a payload-driven, repo-agnosticcheckmode (rulesets/settings/security, non-zero on drift).applyalso enables Dependabot security. shellcheck-clean, verified live against a release and an operational repo. The fleet's forked/stale copies now re-vendor onto the new canonical (parked in the divergence ledger).committerto the signing identity — GitHub verifies the signature against the committer, so a your-key signature over a bot/web-flow committer isunknown_key/unverified. Two-gate rule in AGENTS.md + cross-reference indocs/repo-config-carry.md.Verification
spec/validate.pygreen;configure.shshellcheck-clean andcheckverified live; markdownlint clean; trial merge conflict-free.🤖 Generated with Claude Code