Repository navigation
CodeRabbit pushes unsigned bot commits that block PRs on required_signatures #182
Description
Finding
PR #177 was BLOCKED after every check went green, every review thread was resolved and the code-scanning alert set matched main. The only remaining blocker was required_signatures (rulesets 18110203 and 24256098): two commits on the branch were authored and committed by coderabbitai[bot] and carry no signature.
Measured 2026-10-01 via pulls/177/commits .commit.verification and GraphQL commit.signature:
| commit | author | signature |
|---|---|---|
6aa1b3e |
coderabbitai[bot] | none |
a3ac208 |
coderabbitai[bot] | none |
5a24ec2, 0f59a03, e71cd18 |
owner | VALID |
Nothing in a check-run census shows this. The PR looked ready on every surface except the per-commit verification field.
Cause
CodeRabbit's "commit suggestion" / auto-commit feature pushes commits as the bot's own identity, unsigned. On a repository with required_signatures every such commit makes the PR unmergeable until a human rewrites history. The cure applied on #177 was a git rebase -S of the bot pair only (tree-identical, empty diff) and a --force-with-lease push.
Acceptance criteria
- CodeRabbit no longer pushes commits to branches of this repository (its committable-suggestions / auto-commit setting is off in
.coderabbit.yamlor the app config), or its commits arrive signed. - After the change, a PR that accepts a CodeRabbit suggestion shows every commit with a valid signature in
pulls/{N}/commits. - No PR in this repository opened after the change is blocked on
required_signaturesby a bot commit (positive control: fix(proofs): census reads logical roots from _CoqProject; restore FilesystemCNO.lean pending #167 #177 before the re-sign was so blocked).
Related: #177, #176. Config change is the owner's to make; this issue records the finding and the criteria per the standing stopping rule.
🤖 Generated with Claude Code
Activity