Document strict commit verification default in agent v4

[jamiemonserrate]

Description

Document that Buildkite agent v4 uses strict Git commit verification by default and supports off as the explicit opt-out.

Context

• A-1592: Consider git commit verification strict as default in v4
• Companion implementation: buildkite/agent#4145

Changes

• Add the new default and migration guidance to the agent v3-to-v4 upgrade guide.
• Document strict and off as the supported v4 modes in the Git checkout and command-step references.
• Update the BUILDKITE_GIT_COMMIT_VERIFICATION environment-variable reference.
• Clarify that agent v3 does not verify commits unless configured.
• Explain how v4 handles empty values from agent configuration and job checkout configuration.

Verification

• Markdownlint passes for the three changed Markdown pages.
• The environment-variable content validates against its schema.
• Vale reports no errors, warnings, or suggestions in the changed documentation.
• git diff --check passes.

Deployment

These documentation changes should be published alongside the agent v4 behavior change.

Rollback

Revert this PR if the agent behavior change is reverted.

Disclosures / Credits

OpenAI Codex prepared the documentation updates under Jamie Monserrate's direction.

[buildsworth-bk-app]

One correctness issue in the empty-value migration guidance is inline.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 11195, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

About buildsworth

Model: gpt-5.6-sol with xhigh thinking.

How to request a review: Comment @buildsworth-bk review on the PR, or request buildsworth-bk as a reviewer.

Risk labels (how buildsworth classifies risk) — buildsworth classifies risk itself from the diff. To let it approve, grant L2 approval by mentioning @buildsworth-bk (see L2 approval grant):

• L1 — Low risk (dep bumps, docs/copy, lockfiles, small presentational fixes). buildsworth may approve by default.
• L2 — Standard risk (new UI, additive API fields, refactors). Approved only with an L2 grant; otherwise comment-only.
• L3 — High risk (auth, migrations, payments, secrets, perf-critical paths). Human review always required.

Previous concerns have been addressed.

[buildsworth-bk-app]

The earlier empty-value concern is fixed. One new v3 compatibility issue is inline: the unqualified off guidance replaces the still-supported v3 contract.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 11742, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

[jamiemonserrate]

@buildsworth-bk review

[buildsworth-bk-app]

The v3 compatibility concern is still open, and I found no new issues in this pass.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 11749, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

Previous concerns have been addressed.

[buildsworth-bk-app]

The earlier v3 compatibility concern is fixed. One migration gap remains inline: existing warn configurations also need an explicit v4 replacement.

Want to dig deeper?

Paste this into your agent to explore the findings from this review's Buildkite build:

Download the buildsworth logs from build 11871, then answer my questions about the findings.

Install the reading-buildsworth-logs skill to run this.

Previous concerns have been addressed.

Previous concerns have been addressed.