From f445faf82395555c4131d682fc7b9dcb1328ca86 Mon Sep 17 00:00:00 2001 From: Rhuan Barreto Date: Sat, 2 May 2026 19:30:22 +0200 Subject: [PATCH 1/4] chore(ci): remove backfill-attestations workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The one-time backfill has already been executed — all existing release artifacts are signed. Keeping the workflow around adds unnecessary clutter. Signed-off-by: Rhuan Barreto --- .github/workflows/backfill-attestations.yml | 59 --------------------- 1 file changed, 59 deletions(-) delete mode 100644 .github/workflows/backfill-attestations.yml diff --git a/.github/workflows/backfill-attestations.yml b/.github/workflows/backfill-attestations.yml deleted file mode 100644 index cb2c3e94..00000000 --- a/.github/workflows/backfill-attestations.yml +++ /dev/null @@ -1,59 +0,0 @@ -name: Backfill Release Signatures - -on: - workflow_dispatch: - -permissions: {} - -jobs: - sign: - name: Sign existing release artifacts - runs-on: ubuntu-latest - timeout-minutes: 10 - permissions: - contents: write - id-token: write - steps: - - name: Install cosign - uses: sigstore/cosign-installer@cad07c2e89fa2edd6e2d7bab4c1aa38e53f76003 # v4.1.1 - - - name: Sign release artifacts - env: - GH_TOKEN: ${{ github.token }} - run: | - WORKDIR=$(mktemp -d) - REPO="${{ github.repository }}" - signed=0 - skipped=0 - - for tag in $(gh release list --repo "$REPO" --limit 30 --json tagName --jq '.[].tagName'); do - echo "=== $tag ===" - existing=$(gh release view "$tag" --repo "$REPO" --json assets --jq '.assets[].name') - - for asset in $(echo "$existing" | grep -E '\.(tar\.gz|zip)$'); do - bundle="${asset}.sigstore.json" - - # Skip if already signed - if echo "$existing" | grep -qF "$bundle"; then - echo " $asset — already signed, skipping" - skipped=$((skipped + 1)) - continue - fi - - echo " Signing $asset..." - gh release download "$tag" --repo "$REPO" --pattern "$asset" --dir "$WORKDIR" --clobber - - cosign sign-blob --yes \ - --bundle "$WORKDIR/$bundle" \ - "$WORKDIR/$asset" - - gh release upload "$tag" --repo "$REPO" "$WORKDIR/$bundle" --clobber - - rm -f "$WORKDIR/$asset" "$WORKDIR/$bundle" - signed=$((signed + 1)) - done - done - - rm -rf "$WORKDIR" - echo "" - echo "Done: $signed artifacts signed, $skipped already signed" From 83f95fe21813e7b8dc51d3cc3b0c615c33feef51 Mon Sep 17 00:00:00 2001 From: Rhuan Barreto Date: Sat, 2 May 2026 19:32:10 +0200 Subject: [PATCH 2/4] chore: add agent memory for DCO sign-off requirement Signed-off-by: Rhuan Barreto --- .claude/agent-memory/archgate-developer/MEMORY.md | 4 ++++ .../archgate-developer/feedback_git_signoff.md | 11 +++++++++++ 2 files changed, 15 insertions(+) create mode 100644 .claude/agent-memory/archgate-developer/feedback_git_signoff.md diff --git a/.claude/agent-memory/archgate-developer/MEMORY.md b/.claude/agent-memory/archgate-developer/MEMORY.md index 062a3d20..9c54ce96 100644 --- a/.claude/agent-memory/archgate-developer/MEMORY.md +++ b/.claude/agent-memory/archgate-developer/MEMORY.md @@ -16,6 +16,10 @@ Skipping steps 2 or 3 is a workflow violation. The user should NEVER have to inv - **Pinned version** (`1.3.8`): Set in `.prototools`, referenced in ADR risk sections (ARCH-005, ARCH-006) and CLAUDE.md "Toolchain" section. This is the dev toolchain version. - These are intentionally different. When upgrading the pinned version, update `.prototools` + ADR risk sections + CLAUDE.md toolchain. Do NOT change the minimum unless a new Bun API is required. +## Git Workflow + +- [Always commit with --signoff](feedback_git_signoff.md) — DCO CI check rejects commits without `Signed-off-by` + ## Known Bugs - _(none currently)_ diff --git a/.claude/agent-memory/archgate-developer/feedback_git_signoff.md b/.claude/agent-memory/archgate-developer/feedback_git_signoff.md new file mode 100644 index 00000000..492c7245 --- /dev/null +++ b/.claude/agent-memory/archgate-developer/feedback_git_signoff.md @@ -0,0 +1,11 @@ +--- +name: Always commit with --signoff +description: Every git commit must include DCO sign-off (--signoff flag) — CI enforces DCO Sign-off Check +type: feedback +--- + +Always use `--signoff` (or `-s`) on every `git commit` command. The repo has a DCO Sign-off Check in CI that rejects commits without a `Signed-off-by` trailer. + +**Why:** PR #258 failed the DCO check because the commit was created without `--signoff`. The user had to ask for a fix. + +**How to apply:** Add `--signoff` to every `git commit` invocation — no exceptions, even for trivial changes. From 07dd7fcdef1023cc021724dc3362a110fb0dd2fc Mon Sep 17 00:00:00 2001 From: Rhuan Barreto Date: Sat, 2 May 2026 19:35:07 +0200 Subject: [PATCH 3/4] fix: use bunx for oxfmt hook so it resolves from node_modules MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The PostToolUse hook called bare `oxfmt` which is not in PATH — only available via node_modules/.bin. This caused the hook to silently fail, skipping auto-formatting on Write/Edit. Switch to `bunx oxfmt` which resolves the binary from devDependencies. Signed-off-by: Rhuan Barreto --- .claude/settings.json | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/.claude/settings.json b/.claude/settings.json index a8a70521..f2a49560 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -26,11 +26,10 @@ "hooks": [ { "type": "command", - "command": "jq -r '.tool_input.file_path' | xargs -I {} oxfmt --write {}" + "command": "jq -r '.tool_input.file_path' | xargs -I {} bunx oxfmt --write {}" } ] } ] - }, - "enabledPlugins": { "sentry@claude-plugins-official": true } + } } From e964d93bd7c0510dbb594cd3343f2cfd15f1e6f5 Mon Sep 17 00:00:00 2001 From: Rhuan Barreto Date: Sat, 2 May 2026 19:36:10 +0200 Subject: [PATCH 4/4] chore: merge local settings into project settings Consolidate settings.local.json into settings.json so all project configuration lives in a single checked-in file. Signed-off-by: Rhuan Barreto --- .claude/settings.json | 10 ++++++++-- .claude/settings.local.json | 12 ------------ 2 files changed, 8 insertions(+), 14 deletions(-) delete mode 100644 .claude/settings.local.json diff --git a/.claude/settings.json b/.claude/settings.json index f2a49560..1041439e 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -12,12 +12,17 @@ "Bash(ls *)", "Bash(rm *)", "Bash(proto *)", + "Skill(archgate:architect)", + "Skill(archgate:quality-manager)", + "Skill(archgate:adr-author)", + "WebSearch", "Read", "Write", "Edit", "Glob", "Grep" - ] + ], + "defaultMode": "bypassPermissions" }, "hooks": { "PostToolUse": [ @@ -31,5 +36,6 @@ ] } ] - } + }, + "agent": "archgate:developer" } diff --git a/.claude/settings.local.json b/.claude/settings.local.json deleted file mode 100644 index 92ee3f9e..00000000 --- a/.claude/settings.local.json +++ /dev/null @@ -1,12 +0,0 @@ -{ - "permissions": { - "allow": [ - "Skill(archgate:architect)", - "Skill(archgate:quality-manager)", - "Skill(archgate:adr-author)", - "WebSearch" - ], - "defaultMode": "bypassPermissions" - }, - "agent": "archgate:developer" -}