ci: the DCO rewrite exemption keys on the committer, not the address shape - #81
Merged
Merged
Conversation
…shape #44 widened the exemption for GitHub's squash rewrite by asking whether either address is the <id>+<login>@users.noreply.github.com form. That shape is a symptom, not the rule. An outside contributor's squash landed authored as <jackchen@haloailabs.com> while every commit they pushed was authored and signed off as <nightcityblade@gmail.com>: two real addresses, neither a noreply form, and the exemption could not see it. Two commits on main fail the scan for this reason and no follow-up commit can clear them, because the scan walks every reachable commit. The signature of a GitHub-composed commit is the committer, which is always GitHub <noreply@github.com>. That is what the exemption tests now, which is the rule oxidelake and termlens already use. For such a commit the requirement is that a DCO assertion is present, not that it matches an address GitHub chose. Matching stays enforced where it means something: this job runs on every pull request over the contributor's own commits, which they authored and pushed, and those take the exact-match branch. A squash cannot reach main without that having passed. Exercised against crafted commits, every case in isolation. Must fail, and does: a human commit signed by a different person, a human commit with no trailer, a web-flow commit with no trailer at all, one name with two unrelated addresses and no web-flow marker, a bot author, an AI co-author trailer, a generated-with watermark. Must pass, and does: a human commit with a matching trailer, the contributor-account-address shape, the maintainer-trailer-only shape, and the owner flip #44 was written for. The scan is green over all 36 commits of main. What it does not catch is a maintainer dropping a contributor's trailer while composing a squash body, which is how one of those two commits lost its. The PR-time check is what stands behind the assertion; CONTRIBUTING now says to carry those trailers. Signed-off-by: Vyncint Ng <115854244+vyncint@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Fixes the
attribution and DCO over full historyfailure onmain.What is wrong
#44 widened the squash-rewrite exemption by asking whether either address is the
<id>+<login>@users.noreply.github.comform. That shape is a symptom of a GitHub rewrite, not the rule.An outside contributor's squash landed authored as
<jackchen@haloailabs.com>while every commit they pushed was authored and signed off as<nightcityblade@gmail.com>. Two real addresses, neither a noreply form, so the exemption could not see it. Two commits onmainfail the scan for this reason, and because the scan walks every reachable commit, no follow-up commit can clear them and every PR branched frommaininherits the failure.The fix
The signature of a GitHub-composed commit is the committer, which is always
GitHub <noreply@github.com>. The exemption keys on that now. It is the ruleoxidelakeandtermlensalready use, so this aligns the three.For a GitHub-composed commit the requirement is that a DCO assertion is present, not that it matches an address GitHub picked. Matching stays enforced where it means something: this job also runs on every pull request, over the contributor's own commits, which they authored and pushed — those take the exact-match branch. A squash cannot reach
mainwithout that having passed first.Verification
The scan is green over all 36 commits of
main. Every case below was run in isolation against a crafted commit, using the script extracted verbatim from this workflow:780796dd)ca56368d)e1ceae0)Residual risk, stated
This does not catch a maintainer composing a custom squash body that drops the contributor's
Signed-off-by:. That is howca56368dlostmikemikimike's, which they did give on their own commit. The PR-time check is what stands behind the assertion, and CONTRIBUTING now tells maintainers to carry those trailers into a squash body.