From 18f202c580279f6b14bb8c6f51f276e0de6d55c9 Mon Sep 17 00:00:00 2001 From: Vyncint Ng Date: Sun, 2 Aug 2026 20:23:33 +0700 Subject: [PATCH] ci: allow Co-authored-by trailers in commit-audit MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit GitHub adds a Co-authored-by trailer to every squash-merge (crediting the PR author under their numeric-id noreply address) and to Dependabot commits. commit-audit and its mirrored commit-msg hook scanned for a bare co-authored-by, so those legitimate trailers tripped the required check on main after each merge — most recently the Dependabot group bump in #24, which left main red. Drop the bare co-authored-by term from the forbidden pattern in both places. AI attribution stays blocked by the remaining name-based terms, so an AI co-author trailer is still rejected. Signed-off-by: Vyncint Ng --- .githooks/commit-msg | 7 +++++-- .github/workflows/ci.yml | 6 ++++-- 2 files changed, 9 insertions(+), 4 deletions(-) diff --git a/.githooks/commit-msg b/.githooks/commit-msg index c8d3100..d869c66 100755 --- a/.githooks/commit-msg +++ b/.githooks/commit-msg @@ -1,6 +1,9 @@ #!/bin/sh -# Reject any AI attribution in commit messages. -if grep -qiE 'claude|anthropic|co-authored-by|generated with|ai-assisted' "$1"; then +# Reject AI attribution in commit messages (Claude/Anthropic/"generated with"/ +# "ai-assisted"). Plain Co-authored-by trailers are allowed: GitHub adds them on +# squash-merge and for Dependabot, and an AI co-author is still caught by the +# name patterns above. +if grep -qiE 'claude|anthropic|generated with|ai-assisted' "$1"; then echo "commit-msg hook: forbidden attribution pattern found. Rewrite the message." >&2 exit 1 fi diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index c343d70..6357201 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -64,11 +64,13 @@ jobs: with: fetch-depth: 0 # CI mirror of .githooks/commit-msg: scan every commit message in - # the repository for forbidden attribution patterns. + # the repository for AI attribution. Plain Co-authored-by trailers are + # allowed (GitHub adds them on squash-merge and for Dependabot); an AI + # co-author is still caught by the name patterns. - name: audit commit messages run: | set -eu - pattern='claude|anthropic|co-authored-by|generated with|ai-assisted' + pattern='claude|anthropic|generated with|ai-assisted' matches=$(git log --format='%H %s %b' | grep -icE "$pattern" || true) if [ "$matches" -ne 0 ]; then echo "commit-audit: forbidden attribution pattern found in commit messages:" >&2