Git Workflow

Guidelines for commits, signing, and collaborative development.

Signed Commits Required

The main branch requires all commits to be signed with GPG. This verifies commit authenticity and prevents unauthorized changes.

Setting Up GPG Signing

Step 1: Generate a GPG Key

If you don't have one, generate a new GPG key:

gpg --full-generate-key

Use the same name and email as your GitHub account for the key.

For detailed instructions, see the GitHub GPG Key Generation Guide.

Step 2: Add Your GPG Key to GitHub

1. Export your public key
2. Add it to your GitHub account settings

See the GitHub GPG Key Setup Guide.

Step 3: Configure Git to Sign Commits

Tell Git which GPG key to use:

git config --global user.signingkey <KEY_ID>
git config --global commit.gpgsign true

Replace <KEY_ID> with your GPG key ID.

Optional: Omit --global to only sign commits in this repository:

git config user.signingkey <KEY_ID>
git config commit.gpgsign true

Verifying Your Setup

Make a test commit and verify it's signed:

git commit --allow-empty -m "Test signed commit"
git log --show-signature

You should see "gpg: Good signature" in the output.

Pull Request Process

1. Create a feature branch from the latest main
2. Make your changes and commit them (with proper signing)
3. Push your branch and create a pull request
4. Request review from team members
5. All checks must pass before merging
6. Squash or rebase commits as needed before merge

Best Practices

• Make small, logical commits with clear messages
• Keep commits focused on a single concern
• Reference issues in commit messages when relevant
• Keep commit messages in present tense ("Add feature" not "Added feature")