Skip to content

gogit v0.15.0 Release Notes

Release Date: 2026-10-11

Overview

This release answers one question that gitscan pending could not: are the commits I am about to push signed? Each pending commit now shows whether it carries a signature, and a warning gives the unsigned count when several commits are pending. The same logic is available from Go, and the report building and rendering behind pending and pushed moved into a public report package so library and MCP callers share it with the CLI. No breaking changes to the Go API.

Highlights

See unsigned commits before they reach GitHub

gitscan pending .

Pending commits (not yet pushed to @{upstream}): 3

#  HASH     SIGNED  DAY  TIMESTAMP                  MESSAGE
1  a1b2c3d  yes     Thu  2026-10-08T09:12:04-07:00  feat: add invoice export
2  d4e5f6a  NO      Thu  2026-10-08T09:40:31-07:00  fix: round tax to cents
3  0f9e8d7  yes     Thu  2026-10-08T10:02:55-07:00  docs: describe the export format

WARNING: 1 of 3 commits are not signed.

The warning appears when more than one commit is listed and some are unsigned. gitscan pushed has the same column and warning. In JSON each commit gains signed and each repository an unsigned count; in markdown the table gains a Signed column. See the guide.

Signing is detected from the commit's signature header, not from git's %G? status. With SSH signing and no gpg.ssh.allowedSignersFile, %G? reports "no signature" for commits that are signed, which would have flagged every commit. The trade-off is that the check is presence, not validity: a commit signed with a key GitHub does not know still reads yes here and shows as Unverified there.

Signature state in the library

res, _ := repo.PendingCommits(ctx, "")
fmt.Println(res.UnsignedWarning()) // "1 of 3 commits are not signed", or ""
  • LogOptions.IncludeSignature and Commit.Signed (*bool, nil when not collected); PendingCommits and PushedCommits always collect it.
  • Commit.IsUnsigned, Commit.HasSignature, CountUnsigned, HasSignatureInfo, and SignatureWarning, so callers do not re-implement the policy.
  • PendingResult.UnsignedCount and PendingResult.UnsignedWarning.

A public report package

github.com/grokify/gogit/report holds what the CLI used to do privately:

  • report.Pending and report.Pushed run a query and build Reports, applying the timezone and the pending mode. A repository that cannot be read becomes a Report with Err set instead of failing the sweep.
  • report.BuildEnvelope returns the JSON structure (Envelope, RepoEntry, Row, Summary), ready for an MCP tool to return as is.
  • report.Write renders table, markdown, or JSON.

The cmd package now only parses arguments, drives the progress bar and prints.

Changed

  • The pending and pushed table and markdown output gain a SIGNED column after HASH. Scripts that parse the table by column position should use --format json, which only gains fields.
  • PendingCommits and PushedCommits run one extra git log over the same range to read signature state. It reads commit objects only and does not invoke gpg or ssh.
  • gitscan pushed now validates --tz before running git.

Documentation

Upgrade Notes

Additive for Go callers: Commit gains Signed, LogOptions gains IncludeSignature, and report is new. Commit.Signed is nil from any query that does not set IncludeSignature, so existing code sees no change. The renderer previously in internal/render was not importable, so nothing outside the module depended on it.

Installation

go get github.com/grokify/gogit@v0.15.0
go install github.com/grokify/gogit/cmd/gitscan@v0.15.0

See CHANGELOG.md for the categorized commit list.