Skip to content

docs: require signed commits in contributor docs - #388

Merged
turnipdabeets merged 1 commit into
mainfrom
docs/commit-signing
Oct 23, 2026
Merged

turnipdabeets merged 1 commit into
mainfrom
docs/commit-signing

Conversation

@turnipdabeets

Copy link
Copy Markdown
Contributor

💡 Motivation and Context

main requires signed commits, but nothing in this repo's contributor docs says so. Contributors, especially first-timers and agent-driven ones, keep opening PRs with unsigned commits. Maintainers then have to ask for re-signing before merging. This ports PostHog/posthog-js#5394.

Changes (docs only, no changeset):

  • CONTRIBUTING.md: "Commit signing" section linking to the handbook guide. It tells contributors to set commit.gpgsign to true.
  • AGENTS.md: one line telling agents to sign every commit in the git config they commit with.
  • PR template: "All commits are signed" checklist item.

💚 How did you test it?

Docs only. I read the rendered diff and checked that the handbook anchor #commit-signing exists.

📝 Checklist

  • All commits are signed (see Commit signing)
  • I reviewed the submitted code.
  • I added tests to verify the changes.
  • I updated the docs if needed.
  • No breaking change or entry added to the changelog.

🤖 Agent context

Autonomy: Human-driven (agent-assisted)

Claude Code (Opus) ported the same docs change across the PostHog SDK repos after a maintainer noticed first-time contributors repeatedly opening unsigned PRs. The wording is the same in every repo.

🤖 Generated with Claude Code

Contributors often open PRs with unsigned commits because signing isn't documented here.
@turnipdabeets
turnipdabeets requested a review from a team as a code owner October 22, 2026 22:20
@turnipdabeets turnipdabeets self-assigned this Oct 22, 2026
@turnipdabeets
turnipdabeets enabled auto-merge (squash) October 22, 2026 22:21
@github-actions

github-actions Bot commented Oct 22, 2026 •

Copy link
Copy Markdown
Contributor

posthog-go Compliance Report

Date: 2026-10-22 22:23:36 UTC
Duration: 168928ms

✅ All Tests Passed!

111/111 tests passed


Capture_V1 Tests

✅ 94/94 tests passed

View Details
Test Status Duration
Endpoint And Method.Targets V1 Endpoint ✅ 7ms
Endpoint And Method.Does Not Use Legacy Endpoints ✅ 4ms
Required Headers.Has Authorization Bearer Header ✅ 5ms
Required Headers.Has Content Type Json ✅ 4ms
Required Headers.Has Posthog Sdk Info Format ✅ 5ms
Required Headers.Has Posthog Attempt Header ✅ 5ms
Required Headers.Has Posthog Request Id ✅ 4ms
Required Headers.Has Posthog Request Timestamp ✅ 5ms
Required Headers.Has User Agent ✅ 4ms
Body Format.Body Has Created At And Batch ✅ 5ms
Body Format.No Api Key In Body ✅ 4ms
Body Format.No Sent At In Body ✅ 5ms
Event Format.Event Has Required Root Fields ✅ 4ms
Event Format.Event Uuid Is Valid ✅ 4ms
Event Format.Event Timestamp Is Rfc3339 ✅ 5ms
Event Format.Distinct Id Is String ✅ 15ms
Event Format.Distinct Id At Root Not Properties ✅ 5ms
Event Format.Custom Properties Preserved ✅ 5ms
Event Format.Set Properties Preserved ✅ 4ms
Event Format.Set Once Properties Preserved ✅ 5ms
Event Format.Groups Properties Preserved ✅ 5ms
Event Format.Sdk Generates Uuid If Not Provided ✅ 5ms
Event Format.Event Has Required Root Fields Batch ✅ 6ms
Event Format.Event Uuid Is Valid Batch ✅ 7ms
Event Format.Event Timestamp Is Rfc3339 Batch ✅ 6ms
Event Format.Distinct Id Is String Batch ✅ 6ms
Event Format.Distinct Id At Root Not Properties Batch ✅ 7ms
Event Format.Custom Properties Preserved Batch ✅ 6ms
Event Format.Set Properties Preserved Batch ✅ 6ms
Event Format.Set Once Properties Preserved Batch ✅ 7ms
Event Format.Groups Properties Preserved Batch ✅ 6ms
Event Format.Sdk Generates Uuid If Not Provided Batch ✅ 7ms
Batch Behavior.Multiple Events In Single Batch ✅ 29ms
Batch Behavior.Batch Envelope Smoke ✅ 7ms
Batch Behavior.Flush With No Events Sends Nothing ✅ 3ms
Batch Behavior.Flush At Triggers Batch ✅ 1006ms
Batch Behavior.Created At Reflects Batch Creation Time ✅ 5ms
Deduplication.Generates Unique Uuids ✅ 11ms
Deduplication.Different Events Same Content Different Uuids ✅ 7ms
Deduplication.Preserves Uuid On Retry ✅ 5133ms
Deduplication.Preserves Timestamp On Retry ✅ 5131ms
Deduplication.Preserves Uuid And Timestamp On Batch Retry ✅ 5133ms
Deduplication.No Duplicate Events In Batch ✅ 29ms
Header Behavior On Retry.Attempt Header Starts At One ✅ 5ms
Header Behavior On Retry.Attempt Header Increments On Retry ✅ 10133ms
Header Behavior On Retry.Request Id Preserved On Retry ✅ 5134ms
Header Behavior On Retry.Different Requests Have Different Request Ids ✅ 2012ms
Header Behavior On Retry.Request Timestamp Changes On Retry ✅ 5134ms
Response Format Validation.Success Response Has Uuid Keyed Results ✅ 6ms
Response Format Validation.Success Response Has Ok For Each Event ✅ 26ms
Response Format Validation.Success No Retry After When All Ok ✅ 26ms
Response Format Validation.Success Retry After Present When Retry Events ✅ 129ms
Response Format Validation.Success No Retry After When Drop Only ✅ 26ms
Response Format Validation.Response Echoes Request Id ✅ 15ms
Retry Behavior.Retries On 408 ✅ 5132ms
Retry Behavior.Retries On 500 ✅ 5133ms
Retry Behavior.Retries On 503 ✅ 5135ms
Retry Behavior.Retries On 504 ✅ 5134ms
Retry Behavior.Retryable Errors Have Retry After ✅ 2132ms
Retry Behavior.Respects Retry After On Retryable Error ✅ 8137ms
Retry Behavior.Does Not Retry On 400 ✅ 2131ms
Retry Behavior.Does Not Retry On 401 ✅ 2131ms
Retry Behavior.Does Not Retry On 402 ✅ 2132ms
Retry Behavior.Does Not Retry On 413 ✅ 2131ms
Retry Behavior.Does Not Retry On 415 ✅ 2131ms
Retry Behavior.Non Retryable Errors Have No Retry After ✅ 2131ms
Retry Behavior.Implements Backoff ✅ 15142ms
Retry Behavior.Max Retries Respected ✅ 15142ms
Partial Batch Handling.Handles 200 Full Success ✅ 2008ms
Partial Batch Handling.Handles 200 With All Ok ✅ 3029ms
Partial Batch Handling.Does Not Retry Dropped Events ✅ 3030ms
Partial Batch Handling.Does Not Retry Limited Events ✅ 3030ms
Partial Batch Handling.Prunes Ok Events On Partial Retry ✅ 5134ms
Partial Batch Handling.Prunes Dropped Events On Partial Retry ✅ 5135ms
Partial Batch Handling.Retries Only Retry Events From Partial ✅ 5136ms
Partial Batch Handling.Partial Retry Preserves Uuids ✅ 5134ms
Partial Batch Handling.Partial Retry Attempt Header Increments ✅ 5135ms
Partial Batch Handling.Partial Retry Request Id Preserved ✅ 5135ms
Partial Batch Handling.Respects Retry After On Partial ✅ 5131ms
Partial Batch Handling.Unknown Result Treated As Terminal ✅ 3029ms
Partial Batch Handling.Mixed Ok Drop Limited No Retry ✅ 3031ms
Compression.Sends Gzip Content Encoding ✅ 15ms
Compression.No Content Encoding When Disabled ✅ 5ms
Compression.Compressed Body Is Decompressible ✅ 4ms
Error Handling.Does Not Retry On Unknown 4Xx ✅ 2131ms
Event Options.Cookieless Mode Override ✅ 6ms
Event Options.Disable Skew Correction Override ✅ 4ms
Event Options.Process Person Profile Override ✅ 5ms
Event Options.Product Tour Id Override ✅ 4ms
Event Options.Unset Options Omitted ✅ 5ms
Event Options.Options Override In Batch ✅ 7ms
Geoip And Historical Migration.Geoip Disable Injected Into Properties ✅ 4ms
Geoip And Historical Migration.Historical Migration Set In Body ✅ 4ms
Geoip And Historical Migration.Historical Migration Absent By Default ✅ 5ms

Feature_Flags Tests

✅ 17/17 tests passed

View Details
Test Status Duration
Request Payload.Request With Person Properties Device Id ✅ 14ms
Request Payload.Flags Request Uses V2 Query Param ✅ 15ms
Request Payload.Flags Request Hits Flags Path Not Decide ✅ 14ms
Request Payload.Flags Request Omits Authorization Header ✅ 15ms
Request Payload.Token In Flags Body Matches Init ✅ 14ms
Request Payload.Groups Round Trip ✅ 15ms
Request Payload.Groups Default To Empty Object ✅ 14ms
Request Payload.Disable Geoip False Propagates As Geoip Disable False ✅ 14ms
Request Payload.Disable Geoip Omitted Defaults To False ✅ 15ms
Request Payload.Flag Keys To Evaluate Contains Only Requested Key ✅ 14ms
Request Lifecycle.No Flags Request On Init Alone ✅ 2ms
Request Lifecycle.No Flags Request On Normal Capture ✅ 5ms
Request Lifecycle.Two Flag Calls Produce Two Remote Requests ✅ 27ms
Request Lifecycle.Mock Response Value Is Returned To Caller ✅ 14ms
Retry Behavior.Retries Flags On 502 ✅ 16ms
Retry Behavior.Retries Flags On 504 ✅ 15ms
Side Effect Events.Get Feature Flag Captures Feature Flag Called Event ✅ 15ms

@turnipdabeets
turnipdabeets merged commit 56aa91d into main Oct 23, 2026
35 checks passed
@turnipdabeets
turnipdabeets deleted the docs/commit-signing branch October 23, 2026 09:36
eli-r-ph pushed a commit that referenced this pull request Oct 25, 2026
Contributors often open PRs with unsigned commits because signing isn't documented here.

(cherry picked from commit 56aa91d)
eli-r-ph pushed a commit that referenced this pull request Oct 28, 2026
Contributors often open PRs with unsigned commits because signing isn't documented here.

(cherry picked from commit 56aa91d)
eli-r-ph pushed a commit that referenced this pull request Oct 29, 2026
Contributors often open PRs with unsigned commits because signing isn't documented here.

(cherry picked from commit 56aa91d)
eli-r-ph added a commit that referenced this pull request Oct 29, 2026
…390)

* fix(flags): load shared definitions without a secret key (#366)

* fix(flags): load shared definitions without a secret key

* fix(flags): make keyless cache consumers read-only

(cherry picked from commit 88d8397)

* chore(deps): bump the github-actions group with 2 updates (#373)

Bumps the github-actions group with 2 updates: [github/codeql-action/init](https://github.com/github/codeql-action) and [github/codeql-action/analyze](https://github.com/github/codeql-action).

Updates `github/codeql-action/init` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

Updates `github/codeql-action/analyze` from 4.38.2 to 4.38.3
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@2892aa5...24c5418)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.38.3
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 155480d)

* chore(deps): bump google.golang.org/grpc from 1.83.1 to 1.83.2 in /otel (#377)

Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.83.1 to 1.83.2.
- [Release notes](https://github.com/grpc/grpc-go/releases)
- [Commits](grpc/grpc-go@v1.83.1...v1.83.2)

---
updated-dependencies:
- dependency-name: google.golang.org/grpc
  dependency-version: 1.83.2
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 863b330)

* chore(deps): bump github.com/klauspost/compress from 1.17.11 to 1.18.7 in /posthogmcpsdk in the go_modules group across 1 directory (#379)

chore(deps): bump github.com/klauspost/compress

Bumps the go_modules group with 1 update in the /posthogmcpsdk directory: [github.com/klauspost/compress](https://github.com/klauspost/compress).

Updates `github.com/klauspost/compress` from 1.17.11 to 1.18.7
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](klauspost/compress@v1.17.11...v1.18.7)

---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.18.7
  dependency-type: indirect
  dependency-group: go_modules
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 5c2220b)

* fix(mcp): set $exception_source and strip reserved exception metadata (#357)

* fix(mcp): set $exception_source and correct mechanism.synthetic

The mcp-analytics spec requires the $exception emitted alongside a failed
tool call to carry $exception_source: "mcp.tool_call", and to mark
mechanism.synthetic only for an isError result that carried no thrown
error. buildException set neither correctly: the source property was
absent, and synthetic was hardcoded true on a path only reached for a
thrown error.

Also strip $exception_source from caller-supplied properties, matching
how $exception_level is already protected.

Generated-By: PostHog Desktop
Task-Id: b4b6b8cc-da38-4c24-a978-9e2e9b5ac5f0

* fix(mcp): strip reserved exception metadata

* fix(mcp): keep mechanism.synthetic true until the adapter can mark synthesized errors

---------

Co-authored-by: posthog[bot] <206114724+posthog[bot]@users.noreply.github.com>
Co-authored-by: Ioannis J <yiannis@posthog.com>
(cherry picked from commit de638c7)

* fix(flags): match explicit null properties with string operators (#381)

(cherry picked from commit 870af8a)

* feat(flags): honor experiment holdouts in local flag evaluation (#360)

* feat(flags): honor experiment holdouts in local flag evaluation

Local evaluation ignored `filters.holdout`, so an identifier inside an experiment's holdout was bucketed into a regular variant and disagreed with the server, silently and with no fallback.

Holdout resolution now runs after the inactive-flag check and before release conditions, returning the synthetic `holdout-<id>` variant. Membership uses the flag-level bucketing identity (group key for group-aggregated flags, device id for device-bucketed flags, distinct id otherwise) and the server's hash of `holdout-<value>`: the "-" separator, not the "." used by rollout hashing, selects a different population. Percentages are clamped to 0-100 without truncating fractions, compared inclusively, and 100 includes everyone without hashing. A holdout missing `id` or `exclusion_percentage` is skipped, leaving ordinary evaluation unchanged.

Tested: go build, go vet, gofmt, make api-diff, and go test -race -count=1 ./... at the repository root.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Generated-By: PostHog Desktop
Task-Id: 2887d167-f4e8-446a-a056-202893f6ecd9

* fix(flags): keep device-bucketed partial holdouts inconclusive without a device id

---------

Co-authored-by: posthog[bot] <206114724+posthog[bot]@users.noreply.github.com>
Co-authored-by: Ioannis J <yiannis@posthog.com>
(cherry picked from commit d170fc5)

* chore(deps): bump the github-actions group with 4 updates (#385)

Bumps the github-actions group with 4 updates: [github/codeql-action/init](https://github.com/github/codeql-action), [github/codeql-action/analyze](https://github.com/github/codeql-action), [actions/create-github-app-token](https://github.com/actions/create-github-app-token) and [pnpm/setup](https://github.com/pnpm/setup).

Updates `github/codeql-action/init` from 4.38.3 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@24c5418...6f2ac81)

Updates `github/codeql-action/analyze` from 4.38.3 to 4.39.0
- [Release notes](https://github.com/github/codeql-action/releases)
- [Changelog](https://github.com/github/codeql-action/blob/main/CHANGELOG.md)
- [Commits](github/codeql-action@24c5418...6f2ac81)

Updates `actions/create-github-app-token` from 3.2.0 to 3.3.0
- [Release notes](https://github.com/actions/create-github-app-token/releases)
- [Changelog](https://github.com/actions/create-github-app-token/blob/main/CHANGELOG.md)
- [Commits](actions/create-github-app-token@bcd2ba4...64ab729)

Updates `pnpm/setup` from 3.0.0 to 3.1.1
- [Release notes](https://github.com/pnpm/setup/releases)
- [Commits](pnpm/setup@fbda4c8...a088197)

---
updated-dependencies:
- dependency-name: github/codeql-action/init
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: github/codeql-action/analyze
  dependency-version: 4.39.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: actions/create-github-app-token
  dependency-version: 3.3.0
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
- dependency-name: pnpm/setup
  dependency-version: 3.1.1
  dependency-type: direct:production
  update-type: version-update:semver-minor
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 6ffac5a)

* feat(otel): add per-request context to span processor (#371)

* feat: span processor request context

* fix: span processor review feedback

* fix: span processor review follow-ups

(cherry picked from commit c203229)

* chore(deps): bump github.com/klauspost/compress from 1.17.11 to 1.18.7 in /otel (#380)

chore(deps): bump github.com/klauspost/compress in /otel

Bumps [github.com/klauspost/compress](https://github.com/klauspost/compress) from 1.17.11 to 1.18.7.
- [Release notes](https://github.com/klauspost/compress/releases)
- [Commits](klauspost/compress@v1.17.11...v1.18.7)

---
updated-dependencies:
- dependency-name: github.com/klauspost/compress
  dependency-version: 1.18.7
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
(cherry picked from commit 460c7e6)

* chore: release v1.35.0 [version bump] [skip ci]

(cherry picked from commit 5b7997a)

* chore: release v1.35.1 [version bump] [skip ci]

(cherry picked from commit 4139880)

* chore: release v1.35.2 [version bump] [skip ci]

(cherry picked from commit 87a8371)

* chore: release v1.35.3 [version bump] [skip ci]

(cherry picked from commit 8b65bef)

* chore: release v1.36.0 [version bump] [skip ci]

(cherry picked from commit 4f9ba34)

* build!: release the otel bridge in lockstep with the core major

The otel bridge now imports the core SDK for the request context, so it
moves to github.com/posthog/posthog-go/otel/v2 and shares the core release
version, like posthogmcpsdk. The release workflow sets both nested modules'
core requirement to the new version and tags them after the core release.
Both nested modules run the pinned-core build check through one script.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: require signed commits in contributor docs (#388)

Contributors often open PRs with unsigned commits because signing isn't documented here.

(cherry picked from commit 56aa91d)

* fix(flags): fall back for incompatible local regex evaluation (#387)

* fix(flags): fall back for incompatible local regex evaluation

* fix(flags): preserve regex fallback priority and bound repetition scans

* fix(flags): bound malformed escape scans and reject reversed counts

* fix(flags): defer malformed regex repetitions

(cherry picked from commit e8c7d37)

* feat(otel): add opt-in exception trace context (#374)

* feat(otel): add opt-in exception trace context

Generated-By: PostHog Desktop
Task-Id: 5681be44-4986-48db-b140-1bda88f75f96

* fix(otel): preserve request trace overrides for enqueue clients

Generated-By: PostHog Desktop
Task-Id: 5681be44-4986-48db-b140-1bda88f75f96

(cherry picked from commit 729bcf7)

* fix(otel)!: add derived exception trace IDs only as a pair

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* chore: release v1.36.1 [version bump] [skip ci]

(cherry picked from commit aef332c)

* chore: release v1.36.2 [version bump] [skip ci]

(cherry picked from commit 32f2522)

* chore: release v1.37.0 [version bump] [skip ci]

(cherry picked from commit 5d73532)

* docs: note non-finite numbers and default trace IDs in the v2 migration guide

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: give the non-finite number and trace ID notes their own sections

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs: v2 sends non-finite numbers as null (#394)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* feat(otel): add request context to application spans (#375)

* feat(otel): add request context to application spans

Generated-By: PostHog Desktop
Task-Id: 5681be44-4986-48db-b140-1bda88f75f96

* fix: stop context enrichment after processor shutdown

Generated-By: PostHog Desktop
Task-Id: 5681be44-4986-48db-b140-1bda88f75f96

* fix: skip span context for disabled clients

Generated-By: PostHog Desktop
Task-Id: bfd18848-e498-4352-a58a-b9ba85de4198
(cherry picked from commit 94ff576)

* chore: release v1.38.0 [version bump] [skip ci]

(cherry picked from commit b0a9fae)

* fix(otel): build the context span processor against the v2 core

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* docs(otel): say which trace IDs can mix

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: Dustin Byrne <dustin@posthog.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: posthog[bot] <206114724+posthog[bot]@users.noreply.github.com>
Co-authored-by: Ioannis J <yiannis@posthog.com>
Co-authored-by: Manoel Aranda Neto <5731772+marandaneto@users.noreply.github.com>
Co-authored-by: Carlos Marchal <carlos@posthog.com>
Co-authored-by: releaser-posthog-go[bot] <250614987+releaser-posthog-go[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Anna Garcia <11654201+turnipdabeets@users.noreply.github.com>
Co-authored-by: Paul D'Ambra <paul@posthog.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants