yadflow 3.12.1 → 3.12.2

package/CHANGELOG.md

@@ -1,3 +1,10 @@
+## [3.12.2](https://github.com/abdelrahmannasr/yadflow/compare/v3.12.1...v3.12.2) (2026-07-14)
+
+
+### Bug Fixes
+
+* **checks:** waive verified-commits signature for content-free merge commits ([1e73837](https://github.com/abdelrahmannasr/yadflow/commit/1e738372f821e93020069b565d40315cd7be2591)), closes [#138](https://github.com/abdelrahmannasr/yadflow/issues/138)
+
 ## [3.12.1](https://github.com/abdelrahmannasr/yadflow/compare/v3.12.0...v3.12.1) (2026-07-14)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "yadflow",
-  "version": "3.12.1",
+  "version": "3.12.2",
   "description": "Yadflow — the gated, team, multi-repo SDLC: author → review → build with a PR-driven review gate and a zero-dependency `yad` CLI (setup, gate, commit, open-pr, ship, repo, thread, reconcile). A BMAD module + 38 yad-* skills.",
   "type": "module",
   "author": "AbdelRahman Nasr",

package/skills/yad-checks/references/check-gates.md

@@ -93,6 +93,13 @@ repo. For each commit in `<base>..HEAD`, two independent checks:
   (2+ parents) — a merge's author is whoever pressed merge (often a platform noreply), not a roster
   human, and its content already passed the PR gate suite. This waiver matters for the push-on-default
   `yad-update-guard` (§9), which — unlike this PR-triggered gate — sees merge commits.
+  A merge commit is **additionally signature-waived when it introduces no content of its own** (its
+  combined diff — `git diff-tree --cc` — is empty, i.e. no conflict-resolution or evil-merge hunks):
+  every change it carries already lives in an individually author+signature-checked parent, so there
+  is nothing to protect. This unblocks **self-hosted GitLab**, which does not sign UI-created merge
+  commits (the signature API returns 404) — without it every routine merge would red the branch. A
+  merge that *does* introduce content of its own still requires a verified signature (fail-closed),
+  so an evil merge pushed direct-to-default cannot smuggle in unverified changes.
 
 Degradation is explicit, never silent: a missing allowlist SKIPs the author check with a warning
 (configure roster emails, re-wire); no GitHub/GitLab remote SKIPs the signature check (the badge is a

package/skills/yad-checks/templates/checks/verified-commits.sh

@@ -11,6 +11,12 @@
 # commits set the platform itself as the committer (e.g. noreply@github.com), and their integrity is
 # covered by the signature check (the platform signs them).
 #
+# Merge-commit signature exemption: a merge that introduces NO content of its own (its combined diff
+# is empty — no conflict-resolution / evil-merge hunks) is signature-waived, because every change it
+# carries already lives in its individually author+signature-checked parents. This unblocks self-hosted
+# GitLab, which does not sign UI-created merge commits (the signature API returns 404). A merge that
+# DOES introduce content of its own still requires a verified signature (fail-closed).
+#
 # Degradation is explicit, never silent:
 #   - no allowlist file        -> author check SKIPPED with a warning (configure emails, re-wire)
 #   - no GitHub/GitLab remote  -> signature check SKIPPED with a warning (no platform, no badge)
@@ -88,6 +94,19 @@ signature_verified() {
   esac
 }
 
+# 0 when a merge commit introduced NO content of its own. The combined diff (--cc) lists only hunks
+# that differ from ALL parents, so empty output means every change lives in an individually-checked
+# parent — there is no conflict-resolution or evil-merge content unique to the merge commit, hence
+# nothing an unverified author could smuggle in past the per-parent author+signature checks.
+merge_introduces_no_content() {
+  # `local` on its own line: `local out=$(...)` would mask the substitution's exit status (local
+  # always returns 0). A git error (e.g. a parent tree missing in a shallow clone) must fail closed —
+  # an empty stdout from a *failed* command is not evidence the merge is content-free.
+  local out
+  out="$(git diff-tree --cc --no-commit-id -r "$1")" || return 1
+  [ -z "$out" ]
+}
+
 rc=0
 while IFS= read -r sha; do
   [ -z "$sha" ] && continue
@@ -126,6 +145,11 @@ while IFS= read -r sha; do
   if [ -n "$platform" ]; then
     if signature_verified "$sha"; then
       echo "PASS [verified-commits]: ${short} signature verified by ${platform}"
+    elif [ "$is_merge" = 1 ] && merge_introduces_no_content "$sha"; then
+      # Content-free merge: nothing to protect. Self-hosted GitLab does not sign UI merge commits, so
+      # requiring a signature here would block every routine merge. An evil merge (content of its own)
+      # falls through to FAIL below.
+      echo "WARN [verified-commits]: ${short} unsigned merge commit — introduces no content of its own (covered by verified parents); signature waived. (Self-hosted GitLab does not sign UI merge commits; on a platform that signs its merges an unsigned content-free merge is unusual but still harmless.)"
     else
       echo "FAIL [verified-commits]: ${short} signature missing/unverified — sign commits (GPG/SSH key registered on ${platform}), or the signature API was unreachable (GitLab: set GITLAB_TOKEN/SDLC_API_TOKEN with read_api)."
       rc=1