ci: allow Co-authored-by trailers in commit-audit - #25
Merged
Conversation
GitHub adds a Co-authored-by trailer to every squash-merge (crediting the PR author under their numeric-id noreply address) and to Dependabot commits. commit-audit and its mirrored commit-msg hook scanned for a bare co-authored-by, so those legitimate trailers tripped the required check on main after each merge — most recently the Dependabot group bump in #24, which left main red. Drop the bare co-authored-by term from the forbidden pattern in both places. AI attribution stays blocked by the remaining name-based terms, so an AI co-author trailer is still rejected. Signed-off-by: Vyncint Ng <vyncint@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
commit-audit(and its mirrored.githooks/commit-msg) scanned every commit message for a bareco-authored-byas a forbidden attribution pattern. But GitHub adds aCo-authored-by:trailer on every squash-merge (crediting the PR author under their<numeric-id>+user@users.noreply.github.comaddress, which differs from the local commit author) and to Dependabot commits. Those are legitimate, non-AI trailers — yet they tripped the required check onmainafter each merge.This is what forced a history-rewrite + force-push after the last two merges, and it left
mainred again after the Dependabot group bump in #24 (c093ab0, which carriesCo-authored-by: dependabot[bot] …).Fix
Drop the bare
co-authored-byterm from the forbidden pattern in both the CI job and the mirrored hook:AI attribution stays blocked — a
Co-authored-by: Claude <…@anthropic.com>line is still caught by theclaude/anthropicname terms (plusgenerated with/ai-assisted). Only neutral co-author trailers (a human, or a bot) are now allowed.Verification
commit-auditpasses.#24Dependabot trailer) → confirms this was the cause of the redmain.