doc: derive the commit author from the authenticated account - #16
Merged
Merged
Conversation
Several people commit in these repositories, but this file named one of them as the author for every commit. An agent working for anybody else follows it and puts a colleague's name on code that colleague never wrote or reviewed. That is not hypothetical here: it happened during a consensus fix, the commit reached the default branch, and undoing it took a history rewrite and a force-push over commits other machines had already pulled. Naming the current committers instead would fix today and rot tomorrow, since the list is wrong again as soon as somebody new arrives. Derive the author from the account the session is authenticated as: `gh api user` carries the display name, and the id and login compose the GitHub noreply address that links a commit to its account. The rule against private addresses is therefore unchanged, and no list needs maintaining. Say plainly what not to do as well, because the wrong answer is the one nearest to hand: the author of the last commit is whoever pushed last.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CLAUDE.mdnames a single author for every commit:An agent working for anybody else follows this literally and signs a colleague's
name to code that colleague never wrote or reviewed. Git does not verify the
author field — it is free text from the committer's config — so the commit lands
authored by the named person, linked to their account by the noreply address,
and counted in their contribution graph. The push is authenticated; the
authorship is not.
It has already happened once, in
Sequentia, during a consensus fix thatreached the default branch. Correcting it took a history rewrite and a
force-push over commits other machines had already pulled.
Why not simply list the current committers
Because that is wrong for the same reason, only less often: more than two
accounts can push in this organisation, and any list is stale again the moment
somebody new arrives or one of them leaves. So derive the author from the
account the session is authenticated as:
gh api usercarries the display name, and the id and login compose the GitHubnoreplyaddress that links a commit to its account. Verified against everyhuman account that commits in this organisation. Nothing to maintain, and the
rule against private addresses is unchanged.
The change also says plainly what not to do, because the wrong answer is the
one nearest to hand: the author of the last commit is whoever pushed last, and
says nothing about who is working now.
Why this repository
CLAUDE.mdopens by saying these rules are the same in every Sequentiarepository and are repeated in each one. That is accurate — 25 of the 27
non-archived repositories carry this identical line — and it is why the fix is
worth nothing in only one of them: an agent reads whichever copy it happens to
start from. This is that sweep;
ConcatenaLabs/Sequentia#209carries the sameedit.