`git rebase <base>` is a no-op when HEAD is already a descendant of <base>, which is the normal shape for a local branch built on top of origin/main. Without `--force-rebase`, rebase short-circuits, `-S` never runs, and the unsigned commit gets pushed and rejected by required_signatures branch rules. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>