docs(contributing): clarify verified CI requirement

[kristinapathak]

Summary

• Document that automatic trusted CI for fork PRs requires every commit to be cryptographically signed and GitHub-verified; a DCO sign-off alone is insufficient.
• Add the same distinction to the agent guide and pr-monitor troubleshooting.
• Closes docs: document verified commit signatures for automatic fork CI #12761.

Validation

• git diff --check
• uv run --no-project --with PyYAML python3 scripts/validate_skills.py

---

Summary by CodeRabbit

• Documentation
  • Added guidance for fork pull requests requiring every commit to have a GitHub-verified cryptographic signature.
  • Clarified that DCO sign-off alone is insufficient for automatic testing approval.
  • Added troubleshooting steps for identifying and resolving unverified commits.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[devin-ai-integration]

Devin Review found 1 potential issue.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: bbaea7b1-5ce9-405d-9c49-198dcfe43019

📥 Commits

Reviewing files that changed from the base of the PR and between 42ec62e and b0d5d2a.

📒 Files selected for processing (3)

• .agents/skills/pr-monitor/SKILL.md
• AGENTS.md
• CONTRIBUTING.md

---

Walkthrough

The documentation updates define GitHub-verified signatures on every fork pull request commit as a prerequisite for automatic trusted-CI approval. The PR monitor guidance adds verification commands, summary text, and remediation instructions for unverified commits.

Changes

Fork CI verification

Layer / File(s)	Summary
Document fork approval requirements AGENTS.md, CONTRIBUTING.md	Documents DCO sign-off and GitHub-verified cryptographic signatures for every fork pull request commit. Unverified commits block automatic /ok to test approval.
Add monitoring checks and remediation steps .agents/skills/pr-monitor/SKILL.md	Adds commands to inspect commit verification, an actionable summary for unverified signatures, and instructions to sign and rewrite affected commits.

Estimated code review effort: 2 (Simple) | ~10 minutes

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 inconclusive)

Check name	Status	Explanation	Resolution
Linked Issues check	❓ Inconclusive	The PR documents DCO sign-off and GitHub-verified signatures for fork CI, but the provided context does not confirm a link to GitHub signing instructions.	Confirm that the contributor documentation includes a link to GitHub's commit-signing instructions.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly identifies the documentation change for the verified CI requirement.
Description check	✅ Passed	The description covers the purpose, implementation details, validation, and required issue link, although it uses a custom section layout.
Out of Scope Changes check	✅ Passed	All changes support the linked issue and remain within the requested fork pull request documentation scope.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

🌿 Fern Docs Preview: https://nvidia-preview-01a01bc1-71c2-745f-9b18-87c28cc7dfa1.docs.buildwithfern.com/dynamo/dev

[datadog-official]

🔄 Datadog auto-retried 1 job - 1 passed on retry

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 673bd09 | Docs | Datadog PR Page | Give us feedback!}

[dynamo-ops]

/ok to test 0281aae

[dynamo-ops]

/ok to test c65121f

[harryskim]

Approving — the added prose is accurate against .github/workflows/trigger-ci-approval-flow.yml, and the pages/reference/api/python/* churn is expected generator output.

Non-blocking follow-ups, happy for these to land separately:

1. The English side got this in one place (dco-and-licensing.md) while the zh-CN overview got it in two. The English counterparts of both zh-CN spots are untouched: getting-started.mdx (Configure DCO sign-off step) and contribution-flow.mdx (Complete automated review and CI step). getting-started.mdx is the setup page contributors are routed to, so it's the highest-value place for the note.
2. /ok to test appears nowhere else in docs/fern/pages, so the new section references an undefined term for English readers. The zh-CN overview defines it, which is why it reads fine there.
3. Two things the workflow does that the docs don't say: signing alone isn't sufficient (a contributor not in APPROVED_EXTERNAL_CONTRIBUTORS never gets automatic approval regardless of signatures), and a maintainer can still post /ok to test <sha> manually — the bot's own comment tells contributors they don't need to rewrite commits for that path. Without #3, expect "I signed everything, why no CI?" reports and unnecessary branch-wide re-signing.

Minor: the new section splits the page's Create -> Verify -> Repair spine ("Repair the Latest Commit" now reads as if it repairs the signing problem); Verified is bold in CONTRIBUTING.md but backticked elsewhere; and the Devin comment about the DCO page not being updated is stale.

[dynamo-ops]

/ok to test 19cd52f