From 188b2fb9474699b63fe0ccee68f495e10ff774e2 Mon Sep 17 00:00:00 2001
From: lym953 <10097700+lym953@users.noreply.github.com>
Date: Mon, 2 Nov 2026 15:10:47 -0500
Subject: [PATCH] [SVLS-10001] docs: add CONTRIBUTING.md with commit signing
 steps

GitHub blocks the merge until every commit has a verified signature, and
external contributors often push unsigned commits. The guide tells them
how to sign, how to sign pushed commits again, and to keep "Allow edits
by maintainers" selected. The README links to it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CONTRIBUTING.md | 40 ++++++++++++++++++++++++++++++++++++++++
 README.md       |  2 +-
 2 files changed, 41 insertions(+), 1 deletion(-)
 create mode 100644 CONTRIBUTING.md

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
new file mode 100644
index 000000000..be475be74
--- /dev/null
+++ b/CONTRIBUTING.md
@@ -0,0 +1,40 @@
+# Contributing
+
+Thank you for your interest in the Datadog Lambda Extension. This page tells you what a pull request needs before we can merge it.
+
+## Sign your commits
+
+GitHub blocks the merge of a pull request until every commit in it has a verified signature. Set up signing before you push your first commit:
+
+1. Create a GPG or SSH signing key, and add it to your GitHub account as a signing key. See [Signing commits](https://docs.github.com/en/authentication/managing-commit-signature-verification/signing-commits) in the GitHub documentation.
+2. Configure Git to sign every commit. For an SSH key:
+
+   ```sh
+   git config --global gpg.format ssh
+   git config --global user.signingkey ~/.ssh/id_ed25519.pub
+   git config --global commit.gpgsign true
+   ```
+
+3. Commit with an email address that you verified on your GitHub account. GitHub shows a commit as verified only when the signing key and the committer email belong to the same account.
+
+If you already pushed commits without a signature, sign them again and force-push. Replace `upstream` with the name of your remote for `DataDog/datadog-lambda-extension`:
+
+```sh
+git rebase --exec 'git commit --amend --no-edit -n -S' $(git merge-base HEAD upstream/main)
+git push --force-with-lease
+```
+
+## Open the pull request
+
+- Fill in the pull request template.
+- Keep **Allow edits by maintainers** selected. Then a maintainer can push small changes to your branch, for example to sign the commits again.
+
+## Run the checks
+
+The Rust code is in `bottlecap/`. Before you push, run these commands from that directory. CI runs the same checks:
+
+```sh
+cargo fmt --all -- --check
+cargo clippy --workspace --all-targets --features default
+cargo nextest run --workspace
+```
diff --git a/README.md b/README.md
index 4beda8256..b2033d2ea 100644
--- a/README.md
+++ b/README.md
@@ -97,7 +97,7 @@ You can also open an issue for a feature request.
 
 ## Contributing
 
-If you find an issue with this package and have a fix, please feel free to open a pull request following the [procedures](https://github.com/DataDog/datadog-agent/blob/main/docs/public/guidelines/contributing.md).
+If you find an issue with this package and have a fix, please feel free to open a pull request following the [procedures](https://github.com/DataDog/datadog-agent/blob/main/docs/public/guidelines/contributing.md). See [CONTRIBUTING.md](CONTRIBUTING.md) for what a pull request in this repository needs, such as signed commits.
 
 ## Community