# **What gunnar.rs would refuse, refused here first.**
#
# This repository pushes to TWO remotes on one `origin`: gunnar.rs first, then
# the GitHub mirror. gunnar.rs runs a pre-receive hook, and that hook is the
# authority on what may land there.
#
# The hook runs on PUSH. A pull request merges on GitHub, where it does not run.
# So a PR can put a commit on `main` that gunnar.rs will then refuse forever —
# and the refusal lands on the NEXT person to push, who did not write it.
#
# That is not hypothetical: on 2026-09-10 commit 616ca7b arrived through PR #3
# carrying a `Co-Authored-By: Claude` trailer, and every gunnar.rs push of this
# repository has been refused since. It slipped through twice over — the hook
# never saw the merge, and the branch was pushed from a clone made straight from
# GitHub, which does NOT inherit the dual-URL origin and so never touched
# gunnar.rs at all.
#
# ⚠ The hook is the authority; this job is a MIRROR of it, maintained by hand.
# If the hook's rule changes, change `FORBIDDEN` below with it. A check that has
# drifted from the thing it stands in for is worse than no check, because it is
# believed.
name: mirror-safety
on:
push:
branches: [main]
pull_request:
jobs:
trailers:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
# Every commit the change carries, not just its tip: the mirror
# refuses a push for its OLDEST offending commit as readily as its
# newest, and a PR of ten commits hides nine of them from `HEAD`.
fetch-depth: 0
- name: No trailer gunnar.rs will refuse
env:
BASE: ${{ github.event.pull_request.base.sha }}
HEAD_SHA: ${{ github.event.pull_request.head.sha }}
BEFORE: ${{ github.event.before }}
SHA: ${{ github.sha }}
run: |
set -euo pipefail
FORBIDDEN='^[[:space:]]*co-authored-by:.*(claude|anthropic)'
# **The matcher is proved on a known-bad line every single run.**
# Without this, an empty range, a bad ref or a regex someone edited
# into uselessness all look exactly like success. This job's whole
# value is that it CAN fail.
printf 'Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>\n' \
| grep -qiE "$FORBIDDEN" \
|| { echo "::error::the matcher no longer matches the trailer it exists to catch"; exit 1; }
zero=0000000000000000000000000000000000000000
if [ -n "${BASE:-}" ] && [ -n "${HEAD_SHA:-}" ]; then
range="$BASE..$HEAD_SHA" # a pull request: its own commits
elif [ "${BEFORE:-$zero}" != "$zero" ]; then
range="$BEFORE..$SHA" # a push: what it added
else
range="$SHA~1..$SHA" # a first push: the one commit
fi
echo "range: $range"
bad=0
for c in $(git log --format=%H "$range"); do
if git log -1 --format=%B "$c" | grep -qiE "$FORBIDDEN"; then
echo "::error::$c $(git log -1 --format=%s "$c")"
bad=1
fi
done
if [ "$bad" -ne 0 ]; then
echo
echo "The commits above carry a trailer gunnar.rs refuses, and this"
echo "repository mirrors there. Rewrite the message (git rebase -i,"
echo "or amend for a single commit) and force-push the branch."
echo
echo "monetize-impl is vetra-only and does not have this rule."
exit 1
fi
echo "no forbidden trailers"