commit-policy.yml

# Repo policy (CONTRIBUTING.md): zero AI attribution anywhere, plus DCO
# sign-off on every commit. This checks the full history — the repo is small
# enough that scanning everything is cheaper than getting ranges right.
name: commit-policy

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
          # On PRs, check the real commits — not the synthetic merge commit
          # GitHub fabricates (committer GitHub <noreply@github.com>, no DCO).
          ref: ${{ github.event.pull_request.head.sha || github.sha }}
      - name: Determine the commit range
        id: range
        env:
          EVENT: ${{ github.event_name }}
          BASE: ${{ github.event.pull_request.base.sha }}
          HEAD: ${{ github.event.pull_request.head.sha }}
          BEFORE: ${{ github.event.before }}
          AFTER: ${{ github.event.after }}
        run: |
          if [ "$EVENT" = "pull_request" ]; then
            range="${BASE}..${HEAD}"
          elif [ -z "$BEFORE" ] || [ "$BEFORE" = "0000000000000000000000000000000000000000" ] \
               || ! git cat-file -e "$BEFORE" 2>/dev/null; then
            range="$AFTER"
          else
            range="${BEFORE}..${AFTER}"
          fi
          echo "Checking range: $range"
          echo "range=$range" >> "$GITHUB_OUTPUT"

      - name: DCO sign-off
        env:
          RANGE: ${{ steps.range.outputs.range }}
          # On a push to main, the tip is the commit GitHub composed by
          # squash-merging a pull request. Naming it lets the check tell that
          # one commit apart from anything else with a web-flow committer, so
          # a message GitHub wrote without the trailers it squashed does not
          # fail a pull request that was, in fact, signed off. Empty on
          # pull_request runs, where nothing is exempt.
          COMPOSED: ${{ github.event_name == 'push' && github.event.after || '' }}
        run: .github/scripts/check-dco.sh "$RANGE" "$COMPOSED"

      - name: No AI attribution
        env:
          RANGE: ${{ steps.range.outputs.range }}
        run: .github/scripts/check-no-ai-attribution.sh "$RANGE"
      - name: Check PR body for AI attribution
        if: github.event_name == 'pull_request'
        env:
          PR_BODY: ${{ github.event.pull_request.body }}
        run: |
          printf '%s' "$PR_BODY" > /tmp/pr-body.txt
          if grep -inE 'co-authored-by:.*(claude|copilot|chatgpt|gpt|openai|anthropic|gemini|cursor|codex|devin|aider|assistant|\[bot\])|generated (with|by).*(claude|copilot|chatgpt|gpt|openai|anthropic|gemini|cursor|codex|devin|aider|ai\b)|🤖' /tmp/pr-body.txt; then
            echo "::error::PR body contains AI attribution (repo policy: CONTRIBUTING.md)"
            exit 1
          fi
          echo "PR body clean."