Currently the commit hook we have deployed on the repository has an issue: it will accept a commit that is not merged via a merge commit to be pushed into the repository.

It's not really an issue as the whole thing is still restricted to the Integrators but it means that mistakes might not be seen when releasing e.g. the whole chain would be accepted MyDraftCommitedChange <-- "This is Tuleap X.Y".

Spotted 3 commits since the protection has been added that should have been rejected:

• 8abb85b512cf (accepted because of 1ae6a2e4a51e)
• 759ec025592d (accepted because of a8af10d6ca1b)
• 56a83c735679 (accepted because of 272c69a2fef6)

I verified the diff of these 3 changes, they are fine.

Assisted-by: Discovery assisted by Vercel Deepsec using claude-opus-4.8 and claude-sonnet-5. Internal reference: tuleap-deepsec-other-signature-verification-bypass-45ebb8d6b3.