Repository navigation
ci(guard): refuse agent session links in commits and PR descriptions - #19
Merged
Merged
Conversation
The commitlint step now scans the full message of every commit, merge commits included, and fails when one links to an agent session. The issue-link step checks the PR description for the same link before the no-issue exit, and `edited` re-runs it after a description edit. Failures name the commit by its short SHA and the rule, never the message text, so a public log cannot repeat the link. The match is case-insensitive. The commits API lists at most 250 commits, so the commitlint and DCO steps now fail closed when they checked fewer commits than the PR holds, or when the PR's commit count is missing or not a number. Refs dmfdeploy/dmfdeploy#838 Signed-off-by: znerol2 <6800371+znerol2@users.noreply.github.com>
lkirc
approved these changes
Nov 7, 2026
lkirc
left a comment
lkirc
left a comment
There was a problem hiding this comment.
Approved — manually reviewed the workflow changes at 1a3c55e.
The required checks are green, the exact ntfy OK covers this head, and the added session-link and fail-closed commit-count guards preserve the protected-check names and bypass coverage.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Part of dmfdeploy/dmfdeploy#838: keep agent session links out of PRs and commits. This applies the follow-up for this repo listed in dmfdeploy/dmfdeploy#840.
commitlintstep scans the full message of every commit, merge commits included, and fails when one links to an agent session.issue-linkstep fails on such a link before itsno-issueexit, andeditedre-runs it after a description edit. Every guard job re-runs on an edit. That's deliberate: skipping the scans oneditedwould let an edit cancel a push's scan run and then pass with the scan skipped.commitlintanddcofail closed when they checked fewer commits than the PR holds, or when the PR's commit count is missing or not a number.guard.ymlanddco.ymlwere byte-identical across dmf-central, dmf-env, dmf-infra, dmf-init, dmf-media, dmf-promsd and dmf-runbooks, and stay identical after this change.Verification
gh: 27 of 27 cases pass; 19 of them fail againstorigin/main.actionlintpasses on both files.guard.ymlruns onpull_requestfrom the PR's own workflow file, so this PR's checks run the new steps.Refs dmfdeploy/dmfdeploy#838