The drift-detection workflow ran `git verify-commit` on the runner. SSH-signed commits need a local gpg.ssh.allowedSignersFile to verify, and a GitHub runner has none, so verify-commit failed for every signed commit and the scan recorded it as unsigned. Every commit in this repo is SSH-signed, so the check has been reporting false positives rather than drift — issues #2 and #3 are both from this. GitHub verifies signatures against the keys registered on the author's account, which needs no local trust setup, so the check now reads .commit.verification from the commits API. The verification reason is carried into the issue body, since 'unknown_key' (key not registered) and 'unsigned' (no signature) warrant different responses. Also moves the .github/ path filter ahead of the lookup so commits that touch nothing relevant cost no API call. Verified by running the extracted script against this repo: a 30-day window over the current signed commits yields found=false, and a window wide enough to include the genuinely unsigned db9b599/736e3f1/949bb94 reports all three with reason [unsigned]. Claude-Session: https://claude.ai/code/session_013nxm6vo6gr2YYYW5YirK9Q

Commits

Commits on Sep 9, 2026

fix: resolve full code review — 13 bugs, 8 optimizations, API modernization

chore: ignore local code review artifacts

chore: bump CI actions, widen Python matrix, correct stale docs

fix(ci): verify commit signatures via the GitHub API, not git verify-commit