[dependabot]

Bumps github.com/grokify/gogit from 0.13.1 to 0.15.0.

Release notes

Sourced from github.com/grokify/gogit's releases.

v0.15.0

Release Notes: v0.15.0

Full Changelog: grokify/gogit@v0.14.0...v0.15.0

v0.14.0

Release Notes: v0.14.0

Full Changelog: grokify/gogit@v0.13.1...v0.14.0

Changelog

Sourced from github.com/grokify/gogit's changelog.

[v0.15.0] - 2026-10-11

Highlights

• gitscan pending and gitscan pushed show whether each commit is signed and warn with the unsigned count, so a missing signature is noticed before it appears as Unverified on GitHub

Added

• LogOptions.IncludeSignature and Commit.Signed (*bool, nil when not collected); signing is detected from the commit's signature header rather than git's %G?, which reports no signature for SSH-signed commits when gpg.ssh.allowedSignersFile is unset. PendingCommits and PushedCommits always collect it (b490bcd)
• Commit.IsUnsigned, Commit.HasSignature, CountUnsigned, HasSignatureInfo, SignatureWarning, PendingResult.UnsignedCount and PendingResult.UnsignedWarning so callers share one signing policy: warn only when more than one commit is listed and at least one is unsigned (b490bcd)
• report package: Pending and Pushed build reports from gogit queries (an unreadable repo becomes an error entry), BuildEnvelope returns the JSON-ready structure, and Write renders table, markdown or JSON, so the CLI, library and MCP callers share one implementation (0e446c8)
• SIGNED column in the pending and pushed table and markdown output, a WARNING: N of M commits are not signed. line, and signed per commit and unsigned per repository in JSON (0e446c8)

Changed

• The pending and pushed table and markdown output gain a SIGNED column after HASH; JSON only gains fields (0e446c8)
• Moved report building and rendering from internal/render and cmd into the public report package; gitscan pushed now validates --tz before running git (0e446c8)

Documentation

• Added a guide, "Catch Unsigned Commits Before You Push", in docs/guides/, and documented signature reporting and the report package in the README and AGENTS.md (15f0d03)

Tests

• Signed and unsigned commits with no allowed-signers file, messages that mention a signature header, the warning policy, the raw-log parser, report builders including a broken repo in a fleet and invalid options, and CLI output (fb4db15)

[v0.14.0] - 2026-10-08

Highlights

• gitscan pending --files lists the merged, de-duplicated file paths touched by your unpushed commits, for reviewing or scanning exactly what a push will publish

Added

• Repo.PendingFiles(ctx, sinceCommit) returns PendingCommits plus the sorted, de-duplicated paths touched by those commits in the new PendingResult.Files; it reuses the pending baseline so the commits and files always describe the same range, and lists a rename as the old and the new path (99f9cfe)
• gitscan pending --files adds the merged file list to each repository's report in the table and markdown views and as a files array in JSON; output is unchanged without the flag (2db4d22)

Dependencies

• Bumped github.com/grokify/mogo from 0.74.9 to 0.75.0 (54b2df6)

Documentation

• Added a guide, "Review What a Push Will Publish", in docs/guides/ and documented pending --files in the README and docs home (7803007)
• Moved the gitgrep design note to docs/design/gitgrep-design.md, listed it in the site navigation, and marked it implemented as it shipped in v0.11.0 (a4c7e62)
• Defined the documentation layout (docs/guides, docs/design, docs/releases) and its update rules in AGENTS.md (d0c4f76)
• Documented pending --files in the README (e65a57f)
• Linked the changelog by URL from three release notes so mkdocs build --strict passes (1a4c82d)
• Point the org guidelines reference at AGENTS.md (68787e4)

... (truncated)

Commits

• 5ffa3f4 chore(release): bump the version to 0.15.0
• 5e7651e docs(changelog): record v0.15.0
• 500e844 docs(releases): add v0.15.0 release notes
• cd99595 docs(guides): add a guide to catching unsigned commits before a push
• 15f0d03 docs: document signature reporting and the report package
• fb4db15 test: cover signature detection and commit reports
• 0e446c8 feat(report): add a public commit-report package with signed column
• b490bcd feat: report whether commits are signed
• 3a30d0a docs(releases): add v0.14.0 release notes
• ed07ff9 chore(release): bump the version to 0.14.0
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: c76d0f63-ad7d-4582-a0f5-fa52654c6766

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}