feat: enforce signed commits on pre-push

[skevetter]

Summary

Enforce cryptographically signed commits before pushing to the repository by configuring a pre-push hook.

Changes

• Pre-commit Configuration (.pre-commit-config.yaml):
  • Added default_install_hook_types (pre-commit, pre-push, commit-msg) to ensure pre-push and commit-msg hooks are installed automatically on prek install / pre-commit install.
  • Added check-signed-commits local pre-push hook.
• Verification Tool (hack/check_signed_commits/main.go):
  • Checks commits being pushed via environment variables (PRE_COMMIT_FROM_REF / PRE_COMMIT_TO_REF), stdin (native git pre-push format), or unpushed commits on the current branch.
  • Verifies cryptographic signatures using git verify-commit and commit header inspection (gpgsig, gpgsig-sha256) supporting GPG, SSH, and S/MIME signatures.
  • Rejects unsigned commits with an actionable error message showing commit details and remediation commands.
  • Ignores remote branch deletions.
• Unit Tests (hack/check_signed_commits/main_test.go):
  • Comprehensive unit test coverage for signature header detection, commit range resolution, zero hash detection, and unsigned commit error reporting.

Verification

• go test -v ./hack/check_signed_commits/... (passed)
• golangci-lint run ./hack/check_signed_commits/... (passed, 0 issues)
• prek run --stage pre-push (passed)
• End-to-end testing with signed, unsigned, and branch deletion pushes.

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	9c931cb
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a9f3a03280e950007877c82

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	9c931cb
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a9f3a0332e4d100085c55a0