crickets-and-comb / crickets-and-comb/reference_package
Add commit-signature setup to READMEs and/or CONTRIBUTING.md
- Dominant language
- Python
- Stars
- 1
- Forks
- 2
- PR merge metrics
- No merged PRs in 30d
Description
Crickets and Comb repos require signed commits to merge PRs to main. This is to protect against spoofed commits from malicious actors by ensuring the commits happened on a machine each authorized user has deemed trustworthy. It's mainly important for package releases as an added security signal to consumers.
But, many GitHub users have not set up commit signing, so first-time Crickets and Comb contributors are likely to open a PR with unsigned commits. This means, once they've set up commit signing, they have to make a new branch without unsigned commits in the history and re-create the commits they already made. It should be as simple as squashing a merge commit from the unsigned branch into the new branch (maybe not, I haven't tried it). But, this is a series of hurtles best removed to avoid draining new contributors' motivation with more yaks to shave. Best to just tell them up front to shave this one yak first to avoid shaving more later.
**Task:**
Notify contributors that they will need to set up commit signing before starting work. Do this in READMEs and CONTRIBUTING docs in this repo and the rest in Crickets and Comb.
NOTE: You can update the `CONTRIBUTING.md` doc in [https://github.com/crickets-and-comb/.github](https://github.com/crickets-and-comb/.github), which then should update all repos that were created after this doc was initialized, but I think you'll need to manually update it in some of the older repos? Check every other repos after updating the `crickets-and-comb/.github` repo first, and update as needed.
Please list in a comment in this issue the repos that required manual updating.
Don't link to specific GitHub documentation, but rather instruct them to go find it. Linking to GitHub documentation home is fine. The reasons for this are, one, these docs and URLs change and we want to avoid dead links, and two, because we want to weed out those who aren't willing/able to search and read documentation when they need to.
_So, order of steps:_
1. Update `crickets-and-comb/.github/CONTRIBUTING.md`, as well as its README, and open PR to main.
2. Once that is merged to main, for each of every other repo in Crickets and Comb:
- Update the README.
- If the repo's `.github/CONTRIBUTING.md` does not reflect the changes made in `crickets-and-comb/.github/CONTRIBUTING.md`, update it with identical updates.
- Open PR to main.
3. List in the comments of this issue which repos required an update to their `.github/CONTRIBUTING.md` doc because they didn't reflect the changes made in `crickets-and-comb/.github/CONTRIBUTING.md`.
Contributor guide
Assessment
This issue has not been assessed yet.