fix(ci): don't fail main on a squash message GitHub wrote - #9
Merged
Conversation
GitHub composes the squash-merge message itself, and when the branch contains a merge commit it emits an empty body -- the trailers of the commits it squashed go with it. A pull request in which every commit was signed off then lands on main carrying no Signed-off-by, and check-dco.sh fails the push. Pressing "Update branch" is enough to cause it. That failure cannot be repaired afterwards: main is linear history, non-fast-forward, and the ruleset has no bypass actors. The commit is immutable and the run stays red over a policy that was met. This happened for real in termlens (vyncint/termlens#159), on a pull request whose own commit-policy run was green. This repository runs a byte-identical check-dco.sh against the same COMMIT_MESSAGES squash setting, so it was one merge commit away from the same permanent red. The fix, as landed in vyncint/termlens#160: name the one commit that GitHub composed -- the tip of a push to main, passed as github.event.after -- and exempt only that, and only when it looks like a composed squash merge (web-flow committer, subject ending "(#123)", no sign-off at all). It reports a ::notice::, not silence. Everything else is unchanged. pull_request runs pass no argument and exempt nothing, every other commit keeps the strict sign-off==author check, a web-flow commit without a PR number still fails even when named, and a commit that merely looks composed but is not the named tip still fails. A contributor cannot reach the exemption: being the tip of a push to main means having gone through a pull request that already passed the strict check. Verified here, not just upstream: the failure shape was synthesised on a throwaway branch in this repository and fails unnamed, passes named. actionlint is clean on the workflow. Signed-off-by: Vyncint Ng <115854244+vyncint@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What & why
Closes #8.
Ports vyncint/termlens#160. The
check-dco.shhere was byte-identical to the one that turned termlens'smainpermanently red, and this repo has the same
COMMIT_MESSAGESsquash setting, soit was one Update branch press away from the same failure. The issue has the
diagnosis and the evidence.
The change
check-dco.shtakes an optional second argument naming the commit GitHub mayhave just composed — the tip of the push, passed as
github.event.after, emptyon
pull_requestruns. Exactly that commit is exempted, and only when it lookslike a composed squash merge: web-flow committer, subject ending
(#123), nosign-off at all. It reports a
::notice::rather than passing silently.Deliberately narrow:
pull_requestruns pass no argument, so nothing is exempt there.(#123)still fails, even when named.A contributor cannot reach the exemption. Being the tip of a push to
mainmeans having gone through a pull request, where the strict check already ran and
is a required status check.
Verification
Not just inherited from upstream — the failure shape was synthesised on a
throwaway branch in this repository: an empty commit with committer
noreply@github.comand subject ending(#1), which fails unnamed and passeswhen named as the composed tip.
actionlintis clean on the workflow, and bothpolicy scripts pass on this PR's own commit.
Checklist
Closes #8)paths is in the script header, matching the existing convention
CHANGELOG.mdnot updated — CI-only, nothing user-facing