diff --git a/docs/changelog.md b/docs/changelog.md index 06ec4c7..b3d2a6f 100644 --- a/docs/changelog.md +++ b/docs/changelog.md @@ -281,7 +281,7 @@ Configuration Format: * `.commit-check.yml` has been replaced with `cchk.toml` or `commit-check.toml`. * All YAML configurations must be migrated to TOML from this version onward. -* See the [Migration Guide](migration.md) for step-by-step instructions. +* See [Migrating from v1](migration.md) for step-by-step instructions. Removed Pre-commit Hooks and CLI Options: diff --git a/docs/getting-started.md b/docs/getting-started.md index b3af7d4..6159745 100644 --- a/docs/getting-started.md +++ b/docs/getting-started.md @@ -187,3 +187,6 @@ $ gh attestation verify commit_check-*.whl --repo commit-check/commit-check plus the environment variable and CLI flag that override it. - **[Command-line recipes](example.md)** — checking a range, wiring up CI, reading the JSON output. +- **[Troubleshooting](troubleshoot.md)** — a check failing that you did not + turn on, nothing running at all, and how to get a commit through when you + have to. diff --git a/docs/index.md b/docs/index.md index 60710d0..a41a0fc 100644 --- a/docs/index.md +++ b/docs/index.md @@ -40,7 +40,6 @@ whatever your AI agent is committing on your behalf. hooks: - id: check-message - id: check-branch - - id: check-author-email ``` === "GitHub Actions" @@ -68,58 +67,49 @@ whatever your AI agent is committing on your behalf. } ``` +## Start with two commands + +```console +$ pip install commit-check +$ commit-check --message --branch +``` + +No configuration file needed to start — sensible defaults apply immediately, and +you tighten them when you are ready. Releases carry +[SLSA Level 3](https://slsa.dev) build provenance, so you can verify an artifact +came from this repository's pipeline before you install it. + +[Get started :octicons-arrow-right-24:](getting-started.md){ .md-button .md-button--primary } +[Rules reference](rules.md){ .md-button } + ## Why it exists Git history is a database that every team writes to and almost nobody validates. The cost shows up later, and indirectly. Release notes get written by hand -because commit subjects cannot be grouped. `git bisect` walks through merge -commits that record nothing but a sync. A commit is attributed to `ec2-user` -because a build box had no `user.name`. A contribution has to be rejected months -after the fact because it never carried a `Signed-off-by` trailer. +because commit subjects cannot be grouped. A `git bisect` ends on a merge +commit, where the change that broke the build could be in either parent or in +the resolution. A commit is attributed to `ec2-user` because a build box had no +`user.name`. A branch has its history rewritten months later because none of its +commits carried a `Signed-off-by` trailer. None of these are caught by a linter, a type checker, or a test suite. They are all caught by review — which means inconsistently, by whoever happens to be looking, and only after the work is done. -Commit Check treats commit metadata the way linters treat code: a policy written -down once, enforced identically everywhere, with a stable identifier for every -diagnostic so findings can be discussed, cited, and tracked. - -