Skip to content

commit-policy can fail on main when GitHub composes a squash message without the trailers #15

Description

@vyncint

What

.github/scripts/check-dco.sh here is byte-identical to the one that turned
main permanently red in termlens — see
vyncint/termlens#159 for the
full diagnosis and evidence.

Why it affects this repository

GitHub composes the squash-merge message itself (squash_merge_commit_message: COMMIT_MESSAGES, which is what this repo uses). When the pull request branch
contains a merge commit — pressing Update branch is enough — GitHub
emits an empty body, and the Signed-off-by trailers of the squashed
commits go with it.

The merge then lands on main carrying no sign-off, and check-dco.sh fails
the push. It cannot be fixed afterwards: main is linear history,
non-fast-forward, and the ruleset has no bypass actors. The commit is immutable,
so the run is red forever — over a policy that was, in fact, met, on a pull
request whose own commit-policy run was green.

This is latent here, not yet triggered. One contributor pressing Update
branch
is all it takes.

Fix

Port vyncint/termlens#160: name
the one commit GitHub composed — the tip of the push, github.event.after — and
exempt only that one, and only when it looks like a composed squash merge
(web-flow committer, subject ending (#123), no sign-off at all), reporting a
::notice:: rather than passing silently.

Nothing else changes. pull_request runs exempt nothing, every other commit
keeps the strict sign-off-matches-author check, and a contributor cannot reach
the exemption — being the tip of a push to main means having gone through a
pull request that already passed it.

Note that web_commit_signoff_required is not an alternative: probed
directly, GitHub neither appends a sign-off nor refuses the commit for commits
created through the API, which is how merges land here.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions