Default git commit verification to strict in v4

[jamiemonserrate]

Description

Make Git commit verification a secure default in agent v4.

The agent now uses strict when git-commit-verification is not configured. Operators can explicitly select off to skip verification entirely. The supported v4 modes are strict and off; warn, empty values, and other unsupported CLI values are rejected.

The zero value in a programmatically constructed executor configuration remains fail-closed and behaves as strict. Verification that cannot be completed because of an infrastructure problem remains warning-only, preserving the existing availability behavior.

Context

• A-1592: Consider git commit verification strict as default in v4
• Companion documentation: buildkite/docs#3145

Changes

• Default --git-commit-verification to strict.
• Accept strict and off from flags, environment variables, and config files.
• Make off skip branch-tip fetching and the ancestry check entirely.
• Reject empty and unsupported CLI values instead of treating them as disabled.
• Treat an empty programmatic executor value as strict and reject other unrecognized executor values.

Design decision: explicit off mode

This PR changes both the default and the supported modes. Agent v4 enables verification by default with strict, while off provides an explicit escape hatch for operators who cannot run the verification fetch and ancestry checks.

In strict mode, a definitive branch/commit mismatch fails the job. If the check is unavailable because of an infrastructure problem, the agent warns and continues. Existing skip conditions for HEAD, tags, pull requests, custom refspecs, and builds without a branch remain unchanged.

Testing

Tested that I was able to disable the verification

And when the verification is enabled, it fails properly

Deployment

This is an intentional v4 behavior change. Operators who need to disable verification must set git-commit-verification="off" or BUILDKITE_GIT_COMMIT_VERIFICATION=off. Existing warn or empty configurations must be changed to either strict or off. There are no data migrations.

Rollback

Revert this PR to restore the previous empty default and warn behavior.

Affiliation (optional, external contributors)

Buildkite.

Disclosures / Credits

OpenAI Codex implemented the change and tests under Jamie Monserrate's direction.

[jamiemonserrate]

@buildsworth-bk - review please!

[buildsworth-bk-app]

The warning-path issue is inline. This changes a security policy and the checkout path for every eligible job, so final approval needs a human; the intentional removal of an off mode is the key policy call to confirm.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 11121, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

About buildsworth

Model: gpt-5.6-sol with xhigh thinking.

How to request a review: Comment @buildsworth-bk review on the PR, or request buildsworth-bk as a reviewer.

Risk labels (how buildsworth classifies risk) — buildsworth classifies risk itself from the diff. To let it approve, grant L2 approval by mentioning @buildsworth-bk (see L2 approval grant):

• L1 — Low risk (dep bumps, docs/copy, lockfiles, small presentational fixes). buildsworth may approve by default.
• L2 — Standard risk (new UI, additive API fields, refactors). Approved only with an L2 grant; otherwise comment-only.
• L3 — High risk (auth, migrations, payments, secrets, perf-critical paths). Human review always required.

[buildsworth-bk-app]

No new code findings after the warning-path fix. This still sets a security policy for every eligible checkout and intentionally removes the off mode, so it needs human sign-off; the agent CI build is also currently failing.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 11194, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[buildsworth-bk-app]

The implementation now makes strict the default and retains an explicit off escape hatch. This changes a security policy and the checkout path for every eligible job, so it still needs human sign-off; the migration documentation mismatch is inline.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 11689, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.