commit-trailers.yml

# SPDX-License-Identifier: AGPL-3.0-or-later
# Commercial license available
# © Concepts 1996–2026 Miroslav Šotek. All rights reserved.
# © Code 2020–2026 Miroslav Šotek. All rights reserved.
# ORCID: 0009-0009-3560-0851
# Contact: www.anulum.li | protoscience@anulum.li
# SCPN Quantum Control — Commit-authorship auditor
name: Commit Authorship Audit

on:
  push:
    branches: [main]
  pull_request:
    branches: [main]
  schedule:
    # Weekly Monday 05:00 UTC so any Dependabot merge that sneaks
    # through without the required authorship line is surfaced within 7 days.
    - cron: '0 5 * * 1'
  workflow_dispatch:

permissions:
  contents: read

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0  # v7.0.0
        with:
          # Full history so we can resolve any ref, including the
          # rule-introduction SHA `0c510b4` and PR base SHAs.
          fetch-depth: 0
      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
        with:
          python-version: "3.12"
      - name: Decide audit range
        id: range
        run: |
          set -eu
          case "${{ github.event_name }}" in
            pull_request)
              if [ "${{ github.actor }}" = "dependabot[bot]" ] || \
                 case "$GITHUB_HEAD_REF" in dependabot/*) true ;; *) false ;; esac; then
                # Dependabot branch commits are temporary bot commits. The
                # required trailer is enforced when maintainers squash-merge
                # the PR into main, and the push/scheduled audits still check
                # the resulting main history.
                RANGE=""
              else
                # All commits in the PR.
                RANGE="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
              fi
              ;;
            push)
              # Just the commits introduced by this push.
              BEFORE="${{ github.event.before }}"
              AFTER="${{ github.event.after }}"
              if [ "$BEFORE" = "0000000000000000000000000000000000000000" ]; then
                RANGE="$AFTER^!"
              elif git cat-file -e "$BEFORE^{commit}" 2>/dev/null; then
                RANGE="$BEFORE..$AFTER"
              else
                # Force-push / history-rewrite events can report a
                # `before` SHA that no longer exists in the rewritten
                # checkout. Audit the resulting tip instead of failing
                # on an invalid revision range.
                RANGE="$AFTER^!"
              fi
              ;;
            *)
              # Scheduled / workflow_dispatch: everything since v0.9.6,
              # the first public tag whose post-rule history is clean.
              # Pre-rule debt is grandfathered in HISTORICAL_EXEMPT_SHAS.
              RANGE="v0.9.6..HEAD"
              ;;
          esac
          echo "range=$RANGE" >> "$GITHUB_OUTPUT"
          echo "Audit range: $RANGE"
      - name: Run commit-authorship auditor
        if: steps.range.outputs.range != ''
        run: python tools/check_commit_trailers.py --range "${{ steps.range.outputs.range }}"