fix(cli): validate Git signing format in developer doctor - #6168
Merged
Conversation
check_git_configuration echoed gpg.format back into its pass message without validating it, so an unsupported value (e.g. gpg.format=bogus) still produced "Git commit signing configured (bogus)" and let the doctor report contributor readiness even though Git would reject that format at commit time. Reject any format other than the default (unset), openpgp, ssh, or x509, with a remediation pointing at the supported values. Refs #6119 Signed-off-by: Dongni Yang <dongniy@nvidia.com>
Contributor
📝 WalkthroughWalkthroughThe dev-setup doctor now validates ChangesGit signing format validation
Estimated code review effort: 2 (Simple) | ~10 minutes Related Issues
Related PRs
Suggested labels: bug, tests, dev-tooling Suggested reviewers: none identified 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Comment |
Contributor
Code Coverage OverviewLanguages: TypeScript TypeScript / code-coverage/pluginThe overall coverage in the Show a code coverage summary of the most covered files.
TypeScript / code-coverage/cliThe overall coverage in the Show a code coverage summary of the most covered files.
Updated |
Contributor
E2E Advisor RecommendationRequired E2E: None Full advisor summaryE2E Recommendation AdvisorBase: Required E2E
Optional E2E
New E2E recommendations
|
Contributor
E2E Target RecommendationRequired E2E targets: None Full E2E target advisor summaryE2E Target AdvisorBase: Required E2E targets
Optional E2E targets
Relevant changed files
|
Contributor
PR Review Advisor (Nemotron Ultra) — No blocking findingsMerge posture: No blocking advisor findings This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
Contributor
PR Review Advisor — No blocking findingsMerge posture: No blocking advisor findings Action checklist
Test follow-ups to resolve or justifyIf these cover changed behavior, prefer adding them in this PR; otherwise state why existing coverage is enough or link the follow-up.
This is an automated, non-binding review; it still expects maintainers and agents to respond to each required or warning item. Treat suggestions as current-PR improvements when they touch changed code; defer only with maintainer rationale or a linked follow-up. A human maintainer must make the final merge decision. |
Preserve the gpg.format lookup status so only an absent setting uses the openpgp default. Treat an explicitly empty value as unsupported and cover it with a focused regression test. Refs #6119 Co-authored-by: Dongni Yang <dongniy@nvidia.com> Signed-off-by: Apurv Kumaria <36614+apurvvkumaria@users.noreply.github.com>
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
🧹 Nitpick comments (1)
test/dev-setup-doctor.test.ts (1)
96-99: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueCorrectly distinguishes "unset" from "explicitly empty"
gpg.format.Using
${FAKE_GIT_SIGN_FORMAT-ssh}(no colon) instead of${FAKE_GIT_SIGN_FORMAT:-ssh}correctly preserves an explicitly empty value, matching the production case-statement's${sign_format:-empty}unsupported-format branch. This is a subtle but easy-to-misread distinction — a future edit reintroducing the colon would silently break the empty-format regression test without any linter catching it. Consider a short inline comment noting this is intentional.💬 Optional clarifying comment
*" config --get gpg.format "*) if [ "${FAKE_GIT_SIGN_FORMAT_UNSET:-}" = "1" ]; then exit 1; fi + # No colon: preserves an explicitly empty FAKE_GIT_SIGN_FORMAT ("") as empty, + # only defaulting to "ssh" when the var is truly unset. echo "${FAKE_GIT_SIGN_FORMAT-ssh}" ;;🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@test/dev-setup-doctor.test.ts` around lines 96 - 99, The shell stub in the gpg.format test is relying on the distinction between unset and explicitly empty values, so keep the parameter expansion in the fake git response as the no-colon form in the test helper. Update the snippet around the `config --get gpg.format` case in `test/dev-setup-doctor.test.ts` and add a brief inline note near the `FAKE_GIT_SIGN_FORMAT` expansion to make it clear this is intentional and must preserve the empty-value regression coverage.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In `@test/dev-setup-doctor.test.ts`:
- Around line 96-99: The shell stub in the gpg.format test is relying on the
distinction between unset and explicitly empty values, so keep the parameter
expansion in the fake git response as the no-colon form in the test helper.
Update the snippet around the `config --get gpg.format` case in
`test/dev-setup-doctor.test.ts` and add a brief inline note near the
`FAKE_GIT_SIGN_FORMAT` expansion to make it clear this is intentional and must
preserve the empty-value regression coverage.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 50071a25-7790-4d18-bec0-b27b2cfa3116
📒 Files selected for processing (2)
scripts/dev-setup.shtest/dev-setup-doctor.test.ts
🚧 Files skipped from review as they are similar to previous changes (1)
- scripts/dev-setup.sh
wscurran
added
area: cli
Contributor
|
✨ Thanks for the fix. This addresses the Git signing format validation in the developer doctor with precise remediation for unsupported values. Related open issues: |
21 tasks
cv
approved these changes
Jul 3, 2026
cv
left a comment
cv
left a comment
Collaborator
There was a problem hiding this comment.
Reviewed the signing-format validation and focused regression coverage. CI, CodeRabbit, PR Advisor, DCO, and commit verification are clean; no live E2E is required. Approved for v0.0.74.
This was referenced Jul 3, 2026
ericksoa
added a commit
that referenced
this pull request
Jul 4, 2026
<!-- markdownlint-disable MD041 --> ## Summary This PR prepares the user-facing documentation for v0.0.74 before the release plan is frozen. It expands the release notes across the 56-commit train and closes durable documentation gaps found during the pre-tag commit scan. ## Changes - Expand the `v0.0.74` release notes to cover OpenShell 0.0.72, managed MCP, progressive tool disclosure, LangChain Deep Agents Code, onboarding, local inference, messaging, recovery, and contributor workflows. - Correct the `destroy` contract for retained per-name volumes, gateway-unreachable `--force` cleanup, managed MCP ownership, and same-name recovery. - Document separate remediation for an unreachable container DNS resolver versus one that answers with `NXDOMAIN` or `REFUSED`. - Document the Windows on Arm N1X automatic Ollama safeguard and its remaining large-model limitations. - State that messaging conflicts abort rebuild before backup or deletion, leaving the original sandbox intact. - Link the agent-runnable value benchmark from the contributor task index. - Synchronize generated agent command variants. - Validate with `npm run docs:sync-agent-variants` and `npm run docs`; Fern completed with 0 errors and 2 existing warnings. - Source summary: - [#6020](#6020) and [#5876](#5876) -> `docs/about/release-notes.mdx`: Consolidate the OpenShell 0.0.72 policy boundary and managed MCP lifecycle. - [#6251](#6251) and [#5989](#5989) -> `docs/about/release-notes.mdx`: Summarize progressive tool disclosure and sandbox-first inference controls. - [#6232](#6232), [#6082](#6082), [#6219](#6219), [#6214](#6214), [#6215](#6215), [#6230](#6230), and [#6260](#6260) -> `docs/about/release-notes.mdx`: Summarize the experimental LangChain Deep Agents Code status, secret, version, rebuild, snapshot, and MCP boundaries. - [#6166](#6166), [#6254](#6254), [#6265](#6265), [#6164](#6164), and [#6017](#6017) -> `docs/about/release-notes.mdx`: Summarize BuildKit prebuild, validated image reuse, bounded readiness, and preflight improvements. - [#6150](#6150) -> `docs/about/release-notes.mdx` and `docs/reference/troubleshooting.mdx`: Separate unreachable-resolver remediation from reachable-but-rejected DNS responses. - [#6234](#6234) -> `docs/about/release-notes.mdx`, `docs/inference/use-local-inference.mdx`, and `docs/get-started/windows-preparation.mdx`: Document N1X automatic 9B selection and the remaining explicit-large-model boundary. - [#6129](#6129), [#5987](#5987), [#5955](#5955), and [#6220](#6220) -> `docs/about/release-notes.mdx`, `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Document messaging policy persistence, status, and the pre-destructive conflict check. - [#5963](#5963), [#6050](#6050), [#6094](#6094), [#6238](#6238), [#5988](#5988), [#6235](#6235), [#6181](#6181), and [#5986](#5986) -> `docs/about/release-notes.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Summarize day-two recovery and clarify retained-volume and local-only destroy semantics. - [#6200](#6200), [#6248](#6248), [#6168](#6168), [#6270](#6270), and [#5649](#5649) -> `docs/about/release-notes.mdx` and `CONTRIBUTING.md`: Summarize contributor setup and verification improvements and expose the advisory value benchmark. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: documentation-only release preparation; generated-variant synchronization and the Fern docs build validate the changed pages and routes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: tests are not applicable to this documentation-only change; `npm run docs` validates the source and generated routes. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Expanded setup guidance for Windows on Arm devices with safer default local model selection. * Clarified local inference and sandbox messaging behavior, including conflict checks before rebuilds and safer recovery steps. * Updated destroy/rebuild/reference docs with more detailed warnings, failure handling, and volume-retention guidance. * Improved troubleshooting instructions for Docker DNS issues with clearer paths for unreachable vs. blocked resolvers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary `check_git_configuration` in `scripts/dev-setup.sh` echoed `gpg.format` back into its "Git commit signing configured" pass message without validating it, so an unsupported value (for example, `gpg.format=bogus`) still reported contributor readiness even though Git would reject that format at commit time. This PR distinguishes an absent setting (Git's `openpgp` default) from configured values, accepts only `openpgp`, `ssh`, and `x509`, and rejects explicitly empty or unsupported values with precise remediation. ## Related Issue Fixes NVIDIA#6119 ## Attribution - Original implementation and PR author: Dongni Yang (`@Dongni-Yang`). - The edge-case follow-up commit credits Dongni with `Co-authored-by: Dongni Yang <dongniy@nvidia.com>`. ## Changes - `scripts/dev-setup.sh`: `check_git_configuration` preserves whether `gpg.format` is absent, defaults only an absent setting to `openpgp`, and accepts configured `openpgp`, `ssh`, or `x509` values. Explicitly empty or unsupported values fail with remediation. Existing `commit.gpgsign` and `user.signingkey` checks are unchanged for valid formats. - `test/dev-setup-doctor.test.ts`: parameterizes the fake `git` fixture's `gpg.format` response and adds regression tests covering unsupported and explicitly empty formats, an unset format, and valid `openpgp`, `ssh`, and `x509` formats. ## Type of Change <!-- Check the one that applies. --> - [x] Code change for a new feature, bug fix, or refactor. - [ ] Code change with doc updates. - [ ] Doc only. Prose changes without code sample modifications. - [ ] Doc only. Includes code sample changes. ## Testing <!-- What testing was done? --> - [ ] `npx prek run --all-files` passes (or equivalently `make check`). - [ ] `npm test` passes. - [ ] `make docs` builds without warnings. (for doc-only changes) Verification evidence: - `npx vitest run --project integration test/dev-setup-doctor.test.ts` — 16/16 passing, including a red-before/green-after regression test for explicitly empty `gpg.format`. - `npm run build:cli`, `npm run typecheck:cli`, `npm run checks`, `npm run test:titles:check`, and `npm run test-size:check` passed. - Repository-managed shfmt, ShellCheck, Biome, repository checks, secret scanning, commitlint, and pre-push hooks passed. - The broad local `test-cli` hook was stopped after more than 30 minutes while still progressing through unrelated integration cases. On updated head `bdf422f7`, GitHub CI completed 41 checks with no failures, including all five CLI shards, aggregate CLI tests, ShellCheck, CodeQL, sandbox-image checks, and platform E2E checks. ## Checklist ### General - [x] I have read and followed the [contributing guide](https://github.com/NVIDIA/NemoClaw/blob/main/CONTRIBUTING.md). - [ ] I have read and followed the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). (for doc-only changes) ### Code Changes <!-- Skip if this is a doc-only PR. --> - [x] Formatters applied — `npx prek run --all-files` auto-fixes formatting (or `make format` for targeted runs). - [x] Tests added or updated for new or changed behavior. - [x] No secrets, API keys, or credentials committed. - [ ] Doc pages updated for any user-facing behavior changes — not applicable; this is a contributor-doctor correctness fix and existing contributor guidance remains accurate. ### Doc Changes <!-- Skip if this PR has no doc changes. --> - [ ] Follows the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md). Try running the `update-docs` agent skill to draft changes while complying with the style guide. For example, prompt your agent with "/update-docs catch up the docs for the new changes I made in this PR." - [ ] New pages include SPDX license header and frontmatter, if creating a new page. - [ ] Cross-references and links verified. --- <!-- DCO sign-off (required by CI). Replace with your real name and email. --> Signed-off-by: Dongni Yang <dongniy@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved Git commit signing validation during environment setup to correctly interpret signing format settings, including when unset. * Added clearer guidance when signing information is incomplete or when an unsupported signing format is provided. * Correctly accepts common signing formats and rejects empty or unsupported values with appropriate messaging. * **Tests** * Expanded the environment doctor checks to cover supported, unsupported, unset, and empty signing format scenarios. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Dongni Yang <dongniy@nvidia.com> Signed-off-by: Apurv Kumaria <36614+apurvvkumaria@users.noreply.github.com> Co-authored-by: Apurv Kumaria <36614+apurvvkumaria@users.noreply.github.com> Co-authored-by: Apurv Kumaria <akumaria@nvidia.com>
Hadar301
pushed a commit
to Hadar301/NemoClaw-OpenShift
that referenced
this pull request
Jul 12, 2026
<!-- markdownlint-disable MD041 --> ## Summary This PR prepares the user-facing documentation for v0.0.74 before the release plan is frozen. It expands the release notes across the 56-commit train and closes durable documentation gaps found during the pre-tag commit scan. ## Changes - Expand the `v0.0.74` release notes to cover OpenShell 0.0.72, managed MCP, progressive tool disclosure, LangChain Deep Agents Code, onboarding, local inference, messaging, recovery, and contributor workflows. - Correct the `destroy` contract for retained per-name volumes, gateway-unreachable `--force` cleanup, managed MCP ownership, and same-name recovery. - Document separate remediation for an unreachable container DNS resolver versus one that answers with `NXDOMAIN` or `REFUSED`. - Document the Windows on Arm N1X automatic Ollama safeguard and its remaining large-model limitations. - State that messaging conflicts abort rebuild before backup or deletion, leaving the original sandbox intact. - Link the agent-runnable value benchmark from the contributor task index. - Synchronize generated agent command variants. - Validate with `npm run docs:sync-agent-variants` and `npm run docs`; Fern completed with 0 errors and 2 existing warnings. - Source summary: - [NVIDIA#6020](NVIDIA#6020) and [NVIDIA#5876](NVIDIA#5876) -> `docs/about/release-notes.mdx`: Consolidate the OpenShell 0.0.72 policy boundary and managed MCP lifecycle. - [NVIDIA#6251](NVIDIA#6251) and [NVIDIA#5989](NVIDIA#5989) -> `docs/about/release-notes.mdx`: Summarize progressive tool disclosure and sandbox-first inference controls. - [NVIDIA#6232](NVIDIA#6232), [NVIDIA#6082](NVIDIA#6082), [NVIDIA#6219](NVIDIA#6219), [NVIDIA#6214](NVIDIA#6214), [NVIDIA#6215](NVIDIA#6215), [NVIDIA#6230](NVIDIA#6230), and [NVIDIA#6260](NVIDIA#6260) -> `docs/about/release-notes.mdx`: Summarize the experimental LangChain Deep Agents Code status, secret, version, rebuild, snapshot, and MCP boundaries. - [NVIDIA#6166](NVIDIA#6166), [NVIDIA#6254](NVIDIA#6254), [NVIDIA#6265](NVIDIA#6265), [NVIDIA#6164](NVIDIA#6164), and [NVIDIA#6017](NVIDIA#6017) -> `docs/about/release-notes.mdx`: Summarize BuildKit prebuild, validated image reuse, bounded readiness, and preflight improvements. - [NVIDIA#6150](NVIDIA#6150) -> `docs/about/release-notes.mdx` and `docs/reference/troubleshooting.mdx`: Separate unreachable-resolver remediation from reachable-but-rejected DNS responses. - [NVIDIA#6234](NVIDIA#6234) -> `docs/about/release-notes.mdx`, `docs/inference/use-local-inference.mdx`, and `docs/get-started/windows-preparation.mdx`: Document N1X automatic 9B selection and the remaining explicit-large-model boundary. - [NVIDIA#6129](NVIDIA#6129), [NVIDIA#5987](NVIDIA#5987), [NVIDIA#5955](NVIDIA#5955), and [NVIDIA#6220](NVIDIA#6220) -> `docs/about/release-notes.mdx`, `docs/manage-sandboxes/messaging-channels.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Document messaging policy persistence, status, and the pre-destructive conflict check. - [NVIDIA#5963](NVIDIA#5963), [NVIDIA#6050](NVIDIA#6050), [NVIDIA#6094](NVIDIA#6094), [NVIDIA#6238](NVIDIA#6238), [NVIDIA#5988](NVIDIA#5988), [NVIDIA#6235](NVIDIA#6235), [NVIDIA#6181](NVIDIA#6181), and [NVIDIA#5986](NVIDIA#5986) -> `docs/about/release-notes.mdx`, `docs/reference/commands.mdx`, and `docs/reference/commands-nemohermes.mdx`: Summarize day-two recovery and clarify retained-volume and local-only destroy semantics. - [NVIDIA#6200](NVIDIA#6200), [NVIDIA#6248](NVIDIA#6248), [NVIDIA#6168](NVIDIA#6168), [NVIDIA#6270](NVIDIA#6270), and [NVIDIA#5649](NVIDIA#5649) -> `docs/about/release-notes.mdx` and `CONTRIBUTING.md`: Summarize contributor setup and verification improvements and expose the advisory value benchmark. ## Type of Change - [ ] Code change (feature, bug fix, or refactor) - [ ] Code change with doc updates - [ ] Doc only (prose changes, no code sample modifications) - [x] Doc only (includes code sample changes) ## Quality Gates <!-- Check exactly one tests line and one docs line. Check other lines when applicable. Add every requested justification or approval reference. --> - [ ] Tests added or updated for changed behavior - [ ] Existing tests cover changed behavior — justification: - [x] Tests not applicable — justification: documentation-only release preparation; generated-variant synchronization and the Fern docs build validate the changed pages and routes. - [x] Docs updated for user-facing behavior changes - [ ] Docs not applicable — justification: - [ ] Sensitive paths changed (security, policy, credentials, preflight, onboarding, inference, runner, sandbox, or messaging) - [ ] Sensitive-path review completed or maintainer-approved waiver recorded — reviewer/approval link/justification: - [ ] Non-success, skipped, or missing CI check accepted by maintainer — check name, approval link, and follow-up issue: ## Verification <!-- Check each applicable item only when supported by the requested evidence. Run targeted tests once per relevant change set and rerun after later edits or hook autofixes that can affect the tested behavior. Do not rerun hook-covered checks. --> - [x] PR description includes the DCO sign-off declaration and every commit appears as `Verified` in GitHub - [x] Normal `pre-commit`, `commit-msg`, and `pre-push` hooks passed, or `npm run check:diff` passed when hooks were skipped or unavailable - [x] Targeted behavior tests pass for the current change set, or tests are marked not applicable above — command/result or justification: tests are not applicable to this documentation-only change; `npm run docs` validates the source and generated routes. - [ ] Applicable broad gate passed — `npm test` for broad runtime/test-harness changes; `npm run check` for repo-wide validation/coverage changes — command/result: - [x] Quality Gates section completed with required justifications or waivers - [x] No secrets, API keys, or credentials committed - [ ] `npm run docs` builds without warnings (doc changes only) - [x] Doc pages follow the [style guide](https://github.com/NVIDIA/NemoClaw/blob/main/docs/CONTRIBUTING.md) (doc changes only) - [ ] New doc pages include SPDX header and frontmatter (new pages only) --- <!-- DCO sign-off is required in this PR description, and every commit must appear as Verified in GitHub. Run: git config user.name && git config user.email --> Signed-off-by: Aaron Erickson <aerickson@nvidia.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Documentation** * Expanded setup guidance for Windows on Arm devices with safer default local model selection. * Clarified local inference and sandbox messaging behavior, including conflict checks before rebuilds and safer recovery steps. * Updated destroy/rebuild/reference docs with more detailed warnings, failure handling, and volume-retention guidance. * Improved troubleshooting instructions for Docker DNS issues with clearer paths for unreachable vs. blocked resolvers. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Aaron Erickson <aerickson@nvidia.com>
This was referenced Aug 18, 2026
apurvvkumaria
added a commit
that referenced
this pull request
Aug 19, 2026
…9491) ## Summary `npm run dev:doctor` fails a correctly configured checkout whenever `commit.gpgsign` is stored as anything other than the literal string `true`. `scripts/dev-setup.sh` read the raw token and string-compared it, so the six other spellings git accepts as true were reported as unsigned. This reads `--type=bool` instead, which git normalizes to `true` or `false`. ## Related Issue Fixes #9489 ## Why this matters here `CONTRIBUTING.md` asks contributors to make `dev:doctor` report a configured signing key **before their first commit**, and every commit in a contributor PR must appear as `Verified`. So the false failure lands on exactly the contributors who followed the signing instructions. ## Documentation Writer Review - [x] Documentation writer subagent reviewed the completed changes - Result: `no-docs-needed` - Evidence: The doctor now uses Git boolean parsing. Existing contributor guidance remains accurate. - Agent: Pi CLI <!-- docs-review-head-sha: 8abd8bf --> <!-- docs-review-agents-blob-sha: 993bdd8 --> ## Verification Measured against git 2.50.1, isolated with `GIT_CONFIG_GLOBAL=/dev/null GIT_CONFIG_SYSTEM=/dev/null GIT_CONFIG_NOSYSTEM=1`: | stored | raw read (before) | `--type=bool` (after) | |---|---|---| | `true` | `true` | `true` | | `1` | `1` | `true` | | `yes` | `yes` | `true` | | `on` | `on` | `true` | | `TRUE` / `On` / `YES` | as stored | `true` | | valueless `[commit]\n\tgpgsign` | empty | `true` | | `false` / `0` / `no` / `off` / `FALSE` | as stored | `false` | | unset | empty, rc=1 | empty, rc=1 | | `banana` | `banana` | empty, rc=128 | Seven true spellings were rejected before; all normalize now. The false family still normalizes to `false`, so the change cannot turn a disabled configuration into a pass. Unset and unparseable values still fail closed, unchanged. ## Changes - `scripts/dev-setup.sh` — read `commit.gpgsign` with `git config --get --type=bool`, matching how the neighbouring `gpg.format` check already reads its value directly rather than through the raw helper. - `test/dev-setup-doctor.test.ts` — the fake git in the existing harness now answers the `--type=bool` form, so the existing `reports a ready environment` case exercises the new read path. ## Precedent PR #6168 (merged 2026-07-03, `fix(cli): validate Git signing format in developer doctor`) rewrote this same block: it moved `gpg.format` off the raw helper onto a direct `git config --get` with explicit exit-status handling, and left the `commit.gpgsign` line immediately above it untouched. This finishes that change. ## Testing `npx vitest run --project integration test/dev-setup-doctor.test.ts` → 46 passed. Shell changes carry ShellCheck and shfmt via the repo hooks. ## Type of change - [x] Bug fix Signed-off-by: Udaya Tejas <udayatejas2004@gmail.com> <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Bug Fixes** * Improved detection of Git commit-signing settings. * Correctly interprets Git’s supported boolean values, including enabled, disabled, invalid, unset, and unconfigured settings. * Provides more reliable setup diagnostics when commit signing is configured with different accepted value formats. * Prevents misleading setup results when Git settings use alternate boolean spellings or are unavailable. <!-- end of auto-generated comment: release notes by coderabbit.ai --> --------- Signed-off-by: Udaya Tejas <udayatejas2004@gmail.com> Signed-off-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Prekshi Vyas <prekshiv@nvidia.com> Co-authored-by: Carlos Villela <cvillela@nvidia.com> Co-authored-by: Prekshi Vyas <34834085+prekshivyas@users.noreply.github.com> Co-authored-by: Apurv Kumaria <akumaria@nvidia.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
check_git_configurationinscripts/dev-setup.shechoedgpg.formatback into its "Git commit signing configured" pass message without validating it, so an unsupported value (for example,gpg.format=bogus) still reported contributor readiness even though Git would reject that format at commit time. This PR distinguishes an absent setting (Git'sopenpgpdefault) from configured values, accepts onlyopenpgp,ssh, andx509, and rejects explicitly empty or unsupported values with precise remediation.Related Issue
Fixes #6119
Attribution
@Dongni-Yang).Co-authored-by: Dongni Yang <dongniy@nvidia.com>.Changes
scripts/dev-setup.sh:check_git_configurationpreserves whethergpg.formatis absent, defaults only an absent setting toopenpgp, and accepts configuredopenpgp,ssh, orx509values. Explicitly empty or unsupported values fail with remediation. Existingcommit.gpgsignanduser.signingkeychecks are unchanged for valid formats.test/dev-setup-doctor.test.ts: parameterizes the fakegitfixture'sgpg.formatresponse and adds regression tests covering unsupported and explicitly empty formats, an unset format, and validopenpgp,ssh, andx509formats.Type of Change
Testing
npx prek run --all-filespasses (or equivalentlymake check).npm testpasses.make docsbuilds without warnings. (for doc-only changes)Verification evidence:
npx vitest run --project integration test/dev-setup-doctor.test.ts— 16/16 passing, including a red-before/green-after regression test for explicitly emptygpg.format.npm run build:cli,npm run typecheck:cli,npm run checks,npm run test:titles:check, andnpm run test-size:checkpassed.test-clihook was stopped after more than 30 minutes while still progressing through unrelated integration cases. On updated headbdf422f7, GitHub CI completed 41 checks with no failures, including all five CLI shards, aggregate CLI tests, ShellCheck, CodeQL, sandbox-image checks, and platform E2E checks.Checklist
General
Code Changes
npx prek run --all-filesauto-fixes formatting (ormake formatfor targeted runs).Doc Changes
update-docsagent skill to draft changes while complying with the style guide. For example, prompt your agent with "/update-docs catch up the docs for the new changes I made in this PR."Signed-off-by: Dongni Yang dongniy@nvidia.com
Summary by CodeRabbit