Default git commit verification to strict in v4

[jamiemonserrate]

Description

Make Git commit verification a secure default in agent v4.

The agent now uses strict when git-commit-verification is not configured. Operators can explicitly select warn to continue jobs after a definitive branch/commit mismatch. Empty and unsupported values are rejected instead of disabling verification.

Verification that cannot be completed because of an infrastructure problem remains warning-only, preserving the existing availability behavior.

Context

• A-1592: Consider git commit verification strict as default in v4
• Companion documentation: buildkite/docs#3145

Changes

• Default --git-commit-verification to strict.
• Accept only strict and warn from flags, environment variables, and config files.
• Treat warn as the only mode that downgrades a definitive mismatch to a warning.
• Remove the empty-string verification bypass.
• Add focused tests for the default and the warn override.
• Update an existing short-commit checkout expectation for verification under the new default.

Testing

• Tests have run locally (with go test ./...). Buildkite employees may check this if the pipeline has run automatically.
• Code is formatted (with go tool gofumpt -extra -w .)

The affected packages pass in isolation:

• GIT_CONFIG_GLOBAL=/dev/null go test ./clicommand -count=1
• GIT_CONFIG_GLOBAL=/dev/null go test ./internal/job
• GIT_CONFIG_GLOBAL=/dev/null go test ./env
• GIT_CONFIG_GLOBAL=/dev/null go test ./internal/job/integration -count=1

The full parallel suite was also attempted locally. Unrelated tests intermittently failed with macOS temporary-file bad file descriptor errors, and the user's global Git tag-signing configuration affected a tag fixture. The affected suites pass when run in isolation with the user-level Git configuration disabled.

Deployment

This is an intentional v4 behavior change. Operators that need warning-only behavior must set git-commit-verification="warn" or BUILDKITE_GIT_COMMIT_VERIFICATION=warn. There are no data migrations.

Rollback

Revert this commit to restore the previous empty default and disabled state.

Affiliation (optional, external contributors)

Buildkite.

Disclosures / Credits

OpenAI Codex implemented the change and tests under Jamie Monserrate's direction.