feat(cloud-agent): add createSignedCommit for GitHub-signed commits

[tatoalo]

Problem

Cloud-agent commits must be GitHub-signed ("Verified")

Changes

• adds createSignedCommit to @posthog/git. It sends staged changes through GH's createCommitOnBranch GraphQL mutation
• payload chunking for large diffs (the mutation has a request-size limit)
• shared mapWithConcurrency helper
• execGh stdin (input) support so the GraphQL payload is piped instead of passed via argv
• exports buildPostHogTrailers for the Generated-By / Task-Id trailers

[tatoalo]

• feat(cloud-agent): create GitHub-signed commits in cloud runs #2283
• feat(cloud-agent): add createSignedCommit for GitHub-signed commits #2282 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[greptile-apps]

Prompt To Fix All With AI

Fix the following 2 code review issues. Work through them one at a time, proposing concise fixes.

---

### Issue 1 of 2
packages/git/src/signed-commit.ts:140-158
**Base-branch guard bypassed when `branch` is explicitly provided**

When the caller explicitly passes `input.branch` (e.g. `branch: "main"`), `resolveBranchName` returns early on line 144 before the `baseBranch` comparison is ever reached. A call like `createSignedCommit(ctx, { message: "...", branch: "main" })` will happily commit directly to the protected base branch even when `ctx.baseBranch === "main"`. The guard only fires for the implicit "use HEAD" path.

### Issue 2 of 2
packages/git/src/signed-commit.test.ts:1-57
**Prefer parameterised tests**

The four `chunkFileChanges` cases (deletions-only, single chunk, multi-chunk split, oversized file) share the same function under test and could be expressed with `it.each`, which is the team's preferred style. The split test also doesn't assert `chunks[2].deletions`, leaving an unverified element — a gap that a table-driven test covering all chunks uniformly would naturally close.

_{Reviews (1): Last reviewed commit: "feat(cloud-agent): add createSignedCommi..." | Re-trigger Greptile}

[joshsny]

this feels very annoying to maintain for the signed commits win, anything easier we can do? if not I guess we go with it

[tatoalo]

Merge activity

• May 21, 3:28 PM UTC: @tatoalo merged this pull request with Graphite.