Skip to content

doc: derive the commit author from the authenticated account - #16

Merged
albertodeluigi merged 1 commit into
sequentiafrom
doc/commit-author-from-account
Sep 17, 2026
Merged

albertodeluigi merged 1 commit into
sequentiafrom
doc/commit-author-from-account

Conversation

@albertodeluigi

Copy link
Copy Markdown
Collaborator

CLAUDE.md names a single author for every commit:

Author every commit as GracedEternalKingCabbageMan <151803062+...>.
Never a personal address.

An agent working for anybody else follows this literally and signs a colleague's
name to code that colleague never wrote or reviewed. Git does not verify the
author field — it is free text from the committer's config — so the commit lands
authored by the named person, linked to their account by the noreply address,
and counted in their contribution graph. The push is authenticated; the
authorship is not.

It has already happened once, in Sequentia, during a consensus fix that
reached the default branch. Correcting it took a history rewrite and a
force-push over commits other machines had already pulled.

Why not simply list the current committers

Because that is wrong for the same reason, only less often: more than two
accounts can push in this organisation, and any list is stale again the moment
somebody new arrives or one of them leaves. So derive the author from the
account the session is authenticated as:

git -c user.name="$(gh api user --jq '.name // .login')" \
    -c user.email="$(gh api user --jq '"\(.id)+\(.login)@users.noreply.github.com"')" \
    commit ...

gh api user carries the display name, and the id and login compose the GitHub
noreply address that links a commit to its account. Verified against every
human account that commits in this organisation. Nothing to maintain, and the
rule against private addresses is unchanged.

The change also says plainly what not to do, because the wrong answer is the
one nearest to hand: the author of the last commit is whoever pushed last, and
says nothing about who is working now.

Why this repository

CLAUDE.md opens by saying these rules are the same in every Sequentia
repository and are repeated in each one. That is accurate — 25 of the 27
non-archived repositories carry this identical line — and it is why the fix is
worth nothing in only one of them: an agent reads whichever copy it happens to
start from. This is that sweep; ConcatenaLabs/Sequentia#209 carries the same
edit.

Several people commit in these repositories, but this file named one of
them as the author for every commit. An agent working for anybody else
follows it and puts a colleague's name on code that colleague never wrote
or reviewed.

That is not hypothetical here: it happened during a consensus fix, the
commit reached the default branch, and undoing it took a history rewrite
and a force-push over commits other machines had already pulled.

Naming the current committers instead would fix today and rot tomorrow,
since the list is wrong again as soon as somebody new arrives. Derive the
author from the account the session is authenticated as: `gh api user`
carries the display name, and the id and login compose the GitHub noreply
address that links a commit to its account. The rule against private
addresses is therefore unchanged, and no list needs maintaining.

Say plainly what not to do as well, because the wrong answer is the one
nearest to hand: the author of the last commit is whoever pushed last.
@albertodeluigi
albertodeluigi merged commit 87a9f5e into sequentia Sep 17, 2026
11 of 19 checks passed
@albertodeluigi
albertodeluigi deleted the doc/commit-author-from-account branch September 17, 2026 07:13
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant