feat(#6002): add --signoff flag to github setup command

[fullsend-ai-coder]

Summary

• Add --signoff flag to fullsend github setup that appends a Signed-off-by trailer to scaffold commits, enabling compatibility with repos that enforce DCO checks
• When --signoff is set, the user's identity (name + email) is resolved via the forge API; if unavailable (e.g. bot tokens), the command errors with a clear message
• Without --signoff (default), behavior is unchanged — no trailer is appended, keeping autonomous agent commits exempt per project DCO policy

Context

Repos like kubearchive/kubearchive enforce DCO via a Probot app. When fullsend github setup creates scaffold commits without a Signed-off-by trailer, the DCO check fails and maintainers must manually amend and force-push to add the trailer. This was reported in kubearchive/kubearchive PRs #2001 and #2021.

Testing

• TestRunGitHubSetupPerRepo_SignoffAddsTrailer — verifies the trailer is present in the commit message when --signoff is set
• TestRunGitHubSetupPerRepo_WithoutSignoffOmitsTrailer — verifies no trailer when --signoff is omitted
• TestRunGitHubSetupPerRepo_SignoffMissingIdentity — verifies error when identity cannot be resolved (bot token)
• TestRunGitHubSetupPerRepo_SignoffDirect — verifies trailer works in --direct mode
• TestApplyPerRepoScaffold_WithSignOff / _WithoutSignOff — unit tests for the applyPerRepoScaffold function
• All existing applyPerRepoScaffold tests updated and passing

---

Closes #6002

Post-script verification

• Branch is not main/master (agent/6002-signoff-flag)
• Secret scan passed (gitleaks — 87fd13d4b2ee4c004303313c02526713ce7bc847..HEAD)
• PR body secret scan passed (gitleaks — no-git)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 1:10 PM UTC · Completed 1:27 PM UTC

Commit: 44ab7c2 · View workflow run →

[codecov]

Codecov Report

❌ Patch coverage is 83.33333% with 2 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
internal/cli/admin.go	75.00%	1 Missing ⚠️
internal/cli/github.go	87.50%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Review

Findings

Medium

• [missing-flag-documentation] docs/cli/github.md:58 — The new --signoff flag added to fullsend github setup is missing from the flags table. The table lists all other setup flags (--direct, --runtime, --config, --config-hash) but omits --signoff. Readers consulting this reference would not know the flag exists.
  Remediation: Add a row to the flags table: | --signoff | false | Add Signed-off-by trailer to scaffold commits (requires git user identity) |

• [architectural-coherence] internal/cli/github.go:362 — The github setup command uses an explicit opt-in --signoff flag with hard-failure when identity is unavailable, while github sync-scaffold (github.go:1094) automatically attempts sign-off and degrades gracefully when identity cannot be resolved. This creates inconsistent behavior across CLI commands for the same sign-off concern. The opt-in design is a valid choice (backward-compatible, explicit), but the divergence from the existing auto-sign pattern should be intentional and documented.
  Remediation: Consider aligning with the graceful-degradation pattern used in sync-scaffold, or add a code comment explaining why opt-in with hard-failure is preferred for setup.

• [scope-authorization] PR title — The PR title uses the feat prefix (feat(#6002): add --signoff flag), but issue github setup scaffold commits lack DCO sign-off, breaking repos that enforce DCO #6002 is labeled bug and describes a functional gap ("scaffold commits lack DCO sign-off, breaking repos that enforce DCO"). Per COMMITS.md, GoReleaser uses PR titles to build release notes — a fix prefix would categorize this correctly as a bug fix rather than a new feature.
  Remediation: Consider changing the PR title prefix from feat to fix.

Low

• [error-handling] internal/cli/github.go:367 — The error message --signoff requires git user identity (name and email) says "git user identity" but the identity is resolved via the GitHub API (GetAuthenticatedUserIdentity calls GET /user), not from local git config. A user with local git config but a GitHub App token would find this guidance misleading.
  Remediation: Consider rewording to: --signoff requires a GitHub user identity (name and email) — this is not available for GitHub App tokens.

• [naming-convention] internal/cli/github.go:69 — The new struct field signoff uses single-word naming, while the parameter signOffTrailer in the same change uses camelCase. "Signoff" as a single compound word (like git --signoff) is defensible, but Go convention would favor signOff for a two-word concept.

• [missing-context-documentation] docs/guides/getting-started/configuring-github.md:91 — The getting-started guide links to the CLI reference for setup flags but does not mention --signoff. For repos enforcing DCO, this is the primary entry point — a brief note about the flag would help discoverability.

---

Labels: PR modifies CLI install/setup code in internal/cli/ and adds a new flag to the github setup command

[fullsend-ai-review]

See the review comment for full details.

[fullsend-ai-review]

[medium] architectural-coherence

The github setup command uses an explicit opt-in --signoff flag with hard-failure when identity is unavailable, while github sync-scaffold (github.go:1094) automatically attempts sign-off and degrades gracefully. This creates inconsistent behavior across CLI commands for the same sign-off concern.

Suggested fix: Consider aligning with the graceful-degradation pattern used in sync-scaffold, or add a code comment explaining why opt-in with hard-failure is preferred for setup.

[fullsend-ai-review]

[low] error-handling

The error message says 'git user identity' but the identity is resolved via the GitHub API (GetAuthenticatedUserIdentity calls GET /user), not from local git config. A user with local git config but a GitHub App token would find this guidance misleading.

Suggested fix: Consider rewording to: --signoff requires a GitHub user identity (name and email) -- this is not available for GitHub App tokens.

[fullsend-ai-review]

[low] naming-convention

The new struct field signoff uses single-word naming, while the parameter signOffTrailer in the same change uses camelCase. Go convention would favor signOff for a two-word concept, though signoff as a single compound word (matching git --signoff) is defensible.