ci: narrow the email check to the maintainer's address only - #71
Merged
Conversation
The previous revision of this branch rejected every address that was not a service account, which would have blocked an outside contributor from signing off with their own email. DCO sign-off is somebody's own attestation, so their address there is their choice rather than a leak. Three rules now, in place of one blocklist of five consumer domains: - A sign-off trailer may carry any address. Signed-off-by, Co-Authored-By, Reported-by, Reviewed-by, Tested-by and Acked-by are all exempt. - Anywhere else in the message an address is rejected, because that is how one actually arrives by accident -- pasted from a log line, a stack trace, or a quoted report. - The maintainer's own personal address is rejected everywhere, including in a sign-off, matched by SHA-256 digest. Writing it into a public workflow file in the clear would publish it far more prominently than the old commits this check exists to stop repeating. Validated before pushing rather than after. Against the last 60 commits of all four repositories there is not one email false positive: dependabot's support@github.com sign-off passes, version-pinned filenames like claude_code@2.1.263.json are not treated as addresses, and every remaining failure is a session identifier this check already caught. Against the full history of chock-catalog the digest rule flags all 17 commits that really do carry that address, and no others. The workflow's own run: block was then executed end to end: a contributor gmail sign-off passes, the maintainer address and a pasted log line both fail, and neither is echoed into the log. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>
VISUAL.md is live in the org's .github repository, but GitHub gives no special treatment to that filename -- unlike profile/README.md or the community health files, nothing surfaces it. It sat at a URL that nothing linked to, which for a standard is close to not existing. The person who needs it is editing docs/figures/, so the pointer goes at the top of palette.py, the file they have open. That file is carried byte-identically by four repositories, so one edit reaches all of them. CONTRIBUTING gains a short Figures section for someone browsing rather than editing, which also states the two rules people get wrong: change the shared files at the source rather than in one copy, and never add a per-repo lint or format exclude to work around them. The docstring line stays under 88 characters, so palette.py remains a formatter fixed point -- verified clean under ruff check and ruff format at 88, 100 and 120. Every generated SVG is byte-identical, verified by regenerating and diffing in all four repositories. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>
actionlint runs shellcheck over every run: block and failed this branch on SC2018 and SC2019: tr 'A-Z' 'a-z' only folds ASCII, so an address containing an accented or non-Latin character would not be lowercased before hashing. tr '[:upper:]' '[:lower:]' handles those, which is the point of the rule rather than a style preference. The digest is unchanged for an ASCII address -- verified both forms produce the same SHA-256 -- so the maintainer-address rule keeps matching exactly what it matched before. Found because CI ran a check the local verification did not: a YAML parse proves the file is well-formed, not that the shell inside it is sound. shellcheck is available locally and is now run over the extracted block, which reports all four repositories clean; the old form reproduces SC2018 and SC2019 on demand. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Claude <noreply@anthropic.com>
jothimani-rajendran
marked this pull request as ready for review
September 9, 2026 16:02
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why this exists
#70 merged a version of the email check that rejects every address except a service account. That would block an outside contributor from signing off with their own email — a DCO sign-off is somebody's own attestation, not a leak, and blocking it turns a privacy check into a barrier to contributing. This corrects that; it is live on
mainright now.What the rule is now
Signed-off-by,Co-Authored-By,Reported-by,Reviewed-by,Tested-byandAcked-byare exempt.Also in this branch
docs/figures/palette.pynow points at the visual standard it implements.VISUAL.mdlives in the org's.githubrepository, but GitHub gives no special treatment to that filename — unlikeprofile/README.mdor the community-health files, nothing surfaces it, and nothing linked to it. The pointer goes where the standard actually gets broken: the top of the file someone editing figures already has open.CONTRIBUTING.mdgains a short## Figuressection for readers rather than editors.Verified
@gmailsign-off passes; dependabot'ssupport@github.compasses — and this repo's recent history contains such commits, so the earlier revision would have failed every dependency PR here.run:block, extracted from the merged tree and executed against four throwaway commits: contributor sign-off passes, dependabot passes, maintainer address fails, pasteduser=bob@example.orgfails — and neither address is echoed into the log.palette.pystays a formatter fixed point: clean underruff checkandruff formatat 88, 100 and 120. Every generated SVG byte-identical.Scans only
BASE_SHA..HEAD, unchanged — this repo has 83 pre-existing session-link violations onmain, so a full-history scan would fail every build from day one.🤖 Generated with Claude Code
Generated by Claude Code