Commits don't respect commit.gpgsign git config (unsigned commits)

[oryanmoshe]

Bug Description

When a user has commit.gpgsign = true in their git config, Entire's commits are created unsigned. This causes them to show as "Unverified" on GitHub.

Reproduction

1. Have commit.gpgsign = true in global git config
2. Use Entire with any strategy (manual-commit or auto-commit)
3. Push to remote
4. Check the entire/checkpoints/v1 branch on GitHub — all commits show as "Unverified"

$ git config --global commit.gpgsign
true

$ git log entire/checkpoints/v1 --format="%h %G? %s" -5
693139f N Checkpoint: 3e1dacb3e12b
80f93db N Checkpoint: 3ddab77dd300
8275910 N Checkpoint: 7760c6789eb6
197eafe N Checkpoint: 9407a307186c
f9afd75 N Checkpoint: afc2a8a6b445
# N = no signature

Root Cause

Commits are created via go-git's worktree.Commit() (in auto_commit.go:42) and raw object.Commit structs (in temporary.go:755, push_common.go:206). Neither reads the user's commit.gpgsign git config.

The test infrastructure confirms awareness of this — it explicitly disables signing to prevent test failures:

// testenv.go
cfg.Raw.Section("commit").SetOption("gpgsign", "false")

Suggested Fix

The least invasive approach: read commit.gpgsign from the repo's git config (go-git already supports this via repo.ConfigScoped()), and when true, fall back to git commit CLI for user-facing commits. This:

• Respects the user's existing git config without new Entire config surface
• Handles GPG, SSH, and X.509 signing automatically (since the git CLI does)
• Is consistent with how Entire already uses the git CLI for checkout, fetch, and push
• Doesn't change behavior for users without signing enabled

Alternatively, a new config option (e.g., "gpgSign": true in settings.json) could make this opt-in if the maintainers prefer not to change default behavior.

Files affected

• cmd/entire/cli/strategy/auto_commit.go — commitOrHead() (line 42): most important, creates user-visible commits
• cmd/entire/cli/checkpoint/temporary.go — GitStore.createCommit() (line 755): internal checkpoint commits
• cmd/entire/cli/strategy/push_common.go — createMergeCommitCommon() (line 206): merge commits for session sync

Environment

• Entire CLI (latest as of Feb 2026)
• macOS, GPG signing with key configured via user.signingkey
• commit.gpgsign = true in global git config

[Soph]

Thanks for your contribution!

While your code looks good the issue I'm seeing is that the commits in entire/checkpoints/v1 wouldn't be signed. Is that something you would want to? It's just not that trivial since the commits on the shadow and the entire/checkpoints/v1 branch are done via go-git plumbing APIs without a worktree checkout. Those can't be done through the cli 🤔