Recipe: Signed commits + branch protection

1. Generate a signing key

gpg --full-generate-key
# RSA 4096, 2y expiry, your@email.com

2. Configure Git

git config --global user.signingkey KEYID
git config --global commit.gpgsign true

3. Upload to GitHub

Export your public key and add it under Settings → SSH and GPG keys.

gpg --armor --export KEYID | pbcopy

4. Enforce branch protection

In your repo, go to Settings → Branches → Add rule. Set the pattern to main and check Require signed commits.

5. Verify

git log --show-signature -1

Look for Good signature in the output. Unsigned pushes will now be rejected.