From add88b9d3fa8873b06a188a436602b75b36b0b35 Mon Sep 17 00:00:00 2001
From: tstephen-nhs <231503406+tstephen-nhs@users.noreply.github.com>
Date: Mon, 16 Feb 2026 16:10:21 +0000
Subject: [PATCH] chore: add git ^Cgning check to pre-commit

---
 .pre-commit-config.yaml | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/.pre-commit-config.yaml b/.pre-commit-config.yaml
index 379ceac71..75cff3b54 100644
--- a/.pre-commit-config.yaml
+++ b/.pre-commit-config.yaml
@@ -148,6 +148,35 @@ repos:
 
   - repo: local
     hooks:
+      - id: check-commit-signing
+        name: Check commit signing
+        description: Ensures that commits are GPG signed
+        entry: bash
+        args:
+          - -c
+          - |
+            if ! git config --get user.signingkey > /dev/null 2>&1; then
+              echo "Error: Git signing key not configured."
+              echo "Please configure your GPG signing key with:"
+              echo "  git config user.signingkey <YOUR_GPG_KEY_ID>"
+              echo ""
+              echo "To find your GPG key ID, run: gpg --list-secret-keys --keyid-format=long"
+              echo "For more information, see: https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
+              exit 1
+            fi
+            if ! git config --get commit.gpgsign | grep -q "true" > /dev/null 2>&1; then
+              echo "Error: Commit signing is not enabled."
+              echo "Please enable commit signing with:"
+              echo "  git config commit.gpgsign true"
+              echo ""
+              echo "For more information, see: https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits"
+              exit 1
+            fi
+            echo "Commit signing is properly configured."
+        language: system
+        pass_filenames: false
+        always_run: true
+
       - id: git-secrets
         name: Git Secrets
         description: git-secrets scans commits, commit messages, and --no-ff merges to prevent adding secrets into your git repositories.