ci: block the maintainer's address, leave contributors' alone

[jothimani-rajendran]

What

The "Scan commit messages for local or personal data" job matched five consumer domains — @gmail, @yahoo, @hotmail, @outlook, @protonmail. A contributor at a corporate or self-hosted domain passed straight through, and so did an address pasted into a commit body from a log excerpt or a quoted report, which is how one actually arrives by accident.

Three rules replace that blocklist:

1. A sign-off trailer may carry any address. Signed-off-by, Co-Authored-By, Reported-by, Reviewed-by, Tested-by and Acked-by are exempt. DCO sign-off is somebody's own attestation — their address there is their choice, not a leak, and blocking it would turn a privacy check into a barrier to contributing.
2. Anywhere else in the message, an address is rejected. That is the accidental case.
3. The maintainer's own personal address is rejected everywhere, sign-off included.

Why rule 3 uses a digest

Writing the address into a public workflow file in the clear would publish it far more prominently than the old commits this check exists to stop repeating. It is matched by SHA-256 digest instead, so the file never contains it.

Validated before pushing, not after

Against the last 60 commits of all four repositories: not one email false positive. An earlier revision of this branch had two, both found the same way and fixed —

• dependabot signs off as support@github.com, and this repo's recent history includes such commits, so it would have failed every dependency PR;
• claude_code@2.1.263.json and pkg@1.2.3.tar.gz are filenames, so the last label must look like a TLD and known file suffixes are excluded.

Every remaining failure across that window is a session identifier this check already caught.

The workflow's own run: block was then extracted and executed end to end against three throwaway commits: a contributor @gmail sign-off passes, the maintainer address fails, a pasted user=bob@example.org log line fails — and neither address is echoed into the log, because a log line is a publication too.

Scope unchanged

Still scans only BASE_SHA..HEAD — never full history. This repo has 83 pre-existing session-link violations on main, by far the most in the org; a full-history scan would fail every build from day one. This stops new leaks; it does not clean old ones, which is a settled decision.

🤖 Generated with Claude Code