From 4b02c94f8aeed54da56cdda196c14d9ba9104c5b Mon Sep 17 00:00:00 2001
From: Aric Camarata <aric.camarata@gmail.com>
Date: Sat, 15 Aug 2026 09:50:15 -0400
Subject: [PATCH] fix(ci): let platform-bot co-author trailers pass the
 attribution guard
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

COMMIT_MSG_REGEX blanket-matched any 'co-authored-by:' trailer, while the
sibling CONTENT_REGEX correctly requires an AI vendor name after it. GitHub adds
'Co-authored-by: dependabot[bot]' to squash merges automatically, so every
dependabot squash-merge tripped an AI-ATTRIBUTION policy and turned main red.

Strip dependabot/github-actions/renovate bot trailers before applying the AI
regex. Genuine AI co-author trailers (claude/openai/copilot/anthropic/...) are
still caught, and the CONTENT_REGEX file scan is untouched.

Verified against the failing range 2a3ee2bd..b8c0f6f8 — now passes.
---
 .github/scripts/no-attribution-check.sh | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/scripts/no-attribution-check.sh b/.github/scripts/no-attribution-check.sh
index 08f9b3fb..2fa01bcf 100755
--- a/.github/scripts/no-attribution-check.sh
+++ b/.github/scripts/no-attribution-check.sh
@@ -138,7 +138,15 @@ scan_history_range() {
   # New commits from 2026-03-30 onward must be clean.
   GRANDFATHER_DATE="2026-03-30"
 
-  matches="$(git log --format='%H%n%s%n%b%n---END---' --after="$GRANDFATHER_DATE" "$range" | grep -nE -i "$COMMIT_MSG_REGEX" || true)"
+  # Platform bots (dependabot, github-actions) add a Co-authored-by trailer to
+  # squash merges automatically. That is standard GitHub behaviour, not AI
+  # authorship, and blocking it makes dependabot PRs impossible to squash-merge.
+  # Strip those trailers before applying the AI-attribution regex; genuine AI
+  # co-author trailers (claude/openai/copilot/...) are still caught.
+  BOT_COAUTHOR_REGEX='co-authored-by:[[:space:]]*(dependabot|github-actions|renovate)\[bot\]'
+  matches="$(git log --format='%H%n%s%n%b%n---END---' --after="$GRANDFATHER_DATE" "$range" \
+    | grep -viE "$BOT_COAUTHOR_REGEX" \
+    | grep -nE -i "$COMMIT_MSG_REGEX" || true)"
   if [ -n "$matches" ]; then
     printf '%s\n' "$matches"
     cat >&2 <<'ERROR_TEXT'