ci: block Co-Authored-By: <AI> trailers, recommend Assisted-By#7
ci: block Co-Authored-By: <AI> trailers, recommend Assisted-By#7Andrei Kvapil (kvaps) wants to merge 1 commit into
Conversation
|
Note Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported. |
📝 WalkthroughWalkthroughAdds a read-only GitHub Actions workflow that scans pull request commits for ChangesCommit trailer validation
Estimated code review effort: 2 (Simple) | ~10 minutes Sequence Diagram(s)sequenceDiagram
participant GitHubEvent
participant CommitTrailerWorkflow
participant GitHubAPI
participant JobSummary
GitHubEvent->>CommitTrailerWorkflow: trigger pull_request or merge_group
CommitTrailerWorkflow->>GitHubAPI: paginate pull request commits
GitHubAPI-->>CommitTrailerWorkflow: commit messages
CommitTrailerWorkflow->>JobSummary: write matching commit details
CommitTrailerWorkflow-->>GitHubEvent: succeed or fail workflow
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/commit-trailers.yml:
- Line 49: Update the summary-writing statement in the workflow step to await
the Promise returned by core.summary.write(), ensuring the asynchronous write
completes before the step exits.
- Line 14: Quote the entire step name value in the workflow step named Reject
"Co-Authored-By: <AI>" trailers, using single quotes so the embedded colon-space
sequence is parsed as plain text rather than YAML syntax.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: c3be0272-9bd0-4899-be22-55c507844756
📒 Files selected for processing (1)
.github/workflows/commit-trailers.yml
| no-ai-coauthor: | ||
| runs-on: ubuntu-latest | ||
| steps: | ||
| - name: Reject "Co-Authored-By: <AI>" trailers |
There was a problem hiding this comment.
🎯 Functional Correctness | 🔴 Critical | ⚡ Quick win
Fix YAML syntax error.
The string contains a colon followed by a space (: ) inside an unquoted scalar, which YAML parses as a mapping key-value pair. This causes a syntax error. Wrap the entire value in single quotes.
🐛 Proposed fix
- - name: Reject "Co-Authored-By: <AI>" trailers
+ - name: 'Reject "Co-Authored-By: <AI>" trailers'📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| - name: Reject "Co-Authored-By: <AI>" trailers | |
| - name: 'Reject "Co-Authored-By: <AI>" trailers' |
🧰 Tools
🪛 actionlint (1.7.12)
[error] 14-14: could not parse as YAML: mapping values are not allowed in this context
(syntax-check)
🪛 YAMLlint (1.37.1)
[error] 14-14: syntax error: mapping values are not allowed here
(syntax)
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/commit-trailers.yml at line 14, Quote the entire step name
value in the workflow step named Reject "Co-Authored-By: <AI>" trailers, using
single quotes so the embedded colon-space sequence is parsed as plain text
rather than YAML syntax.
Source: Linters/SAST tools
myasnikovdaniil
left a comment
myasnikovdaniil
left a comment
There was a problem hiding this comment.
Andrei Kvapil (@kvaps) Please widen check to other popular agents and address bot reviews. Also commit signoff is missing.
Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
a232ef7 to
c79badf
Compare
There was a problem hiding this comment.
🧹 Nitpick comments (1)
.github/workflows/commit-trailers.yml (1)
51-63: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low valueImprove markdown formatting for the job summary.
In GitHub Actions job summaries, single newlines within the same block are rendered as spaces in Markdown. As currently written, the last two actionable lines will wrap together into a single sentence.
Consider formatting them as a bulleted list (or using double newlines) so they render clearly on separate lines.
♻️ Proposed refactor
const msg = [ `Commits ${offenders.join(', ')} carry a "Co-Authored-By: <AI agent>" trailer.`, '', 'Under US copyright law (which governs CNCF projects) a Co-Authored-By', 'trailer naming an AI agent can attribute rights over the code to its', 'vendor. Use an informational "Assisted-By: <agent>" trailer instead — it', 'discloses AI assistance without transferring authorship.', '', 'Rationale: https://github.com/anthropics/claude-code/issues/66602', '', - 'Fix: rebase and amend the trailer, then force-push.', - 'Prevent it at source: set includeCoAuthoredBy: false in your Claude Code settings.', + '- **Fix:** rebase and amend the trailer, then force-push.', + '- **Prevent it at source:** set `includeCoAuthoredBy: false` in your Claude Code settings.', ].join('\n');🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/commit-trailers.yml around lines 51 - 63, Update the msg construction in the workflow so the final “Fix” and “Prevent it at source” actions render as distinct Markdown lines in the GitHub Actions job summary, preferably by formatting them as separate bullets or blocks while preserving their existing text.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.github/workflows/commit-trailers.yml:
- Around line 51-63: Update the msg construction in the workflow so the final
“Fix” and “Prevent it at source” actions render as distinct Markdown lines in
the GitHub Actions job summary, preferably by formatting them as separate
bullets or blocks while preserving their existing text.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: a1dcf8ae-f6d5-46c5-9934-c5f91e1a5756
📒 Files selected for processing (1)
.github/workflows/commit-trailers.yml
|
Addressed:
On enforcing it in the agents themselves: |
2 participants
What
Adds an org-wide reusable workflow
commit-trailersthat fails a PR when any of its commits carries aCo-Authored-By: <…@anthropic.com>trailer (the trailer Claude Code stamps by default), and points the contributor at an informationalAssisted-By: Claudetrailer instead.Intended to be enforced across the org via an Organization Ruleset → "Require workflows to pass before merging" pointing at this file (added separately by an org admin, in
Evaluatemode first).Why
Under US copyright law — which governs CNCF projects — a
Co-Authored-Bytrailer naming an AI agent can attribute rights over the code to its vendor.Assisted-By:discloses AI assistance without transferring authorship, and is the emerging convention (Linux kernel, Fedora, LLVM). See anthropics/claude-code#66602.Notes
@anthropic.comaddress, so it does not block legitimate human co-authors.includeCoAuthoredBy: false.Summary by CodeRabbit