feat: an attribution check seven repositories were each carrying - #4
Merged
Conversation
added 2 commits
August 23, 2026 00:43
Every repository failed a pull request that credits an AI assistant, using its own embedded copy of the same 60 lines of bash. Nothing about the rule varied by repository, so the copies could only drift — and two variants had already appeared, differing in indentation alone. The pattern stays anchored to the start of a line, which is what lets a pull request describe the rule without tripping it. Findings gain a position: pull/123/body:5:3 rather than a bare error, addressing the subject itself since none of the three is a file. This repository, the only one that had no such check, now runs it on its own pull requests by local path, so a change to the action is checked by the version that changes it. Closes #3
The token input's description cited the expression a caller passes, braces and all. A manifest is evaluated wherever those braces appear, description included, and `github` is not a context an action manifest has — so every workflow calling the action failed to load it, this repository's own among them. The description now names the context without writing an expression, and says why.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Every HeroicLands repository already failed a pull request whose title, body, or commit messages credit an AI assistant. Each did it with its own embedded copy of the same 60 lines of
bashandgh— seven copies, already in two variants that differ only in indentation. Nothing about the rule varies by repository, so there was nothing for an input to capture, and nothing the copies could do but drift.actions/no-attributionreads the three subjects attribution reaches a pull request through: the title and body, which a human edits, and the commit messages, which survive the merge. All three are reported in one run, so a two-line fix is not two round trips.The detection pattern is unchanged, anchored to the start of a line — real attribution stands at column zero, so a pull request can describe the rule without tripping it. That property is load-bearing and was checked against this repository`s own history: the pull request that first introduced the guard, whose prose mentions both forbidden phrases, still passes.
Findings gain a position they did not have:
pull/123/body:5:3: error: …rather than a bare message. The address is not a file path, because none of these subjects is a file — it is the subjects own address,pull/123/bodyorcommit/, so a finding names something you can open orgit show, and the column is the trailers own rather than the start of the line.This repository was the only one with no such check at all. It now runs one, addressing the action by local path rather than by
HeroicLands/.github@main, so a pull request that changes the action is checked by its own version of it — and so the check could be introduced here without failing the pull request introducing it.Verified against real data before shipping: a clean pull request passes and counts the commits it read; a title, an indented trailer, and an emoji-prefixed signature are each found at the right line and column; a mid-sentence mention is not; and a commit-message trailer is reported against its own sha.
The seven repositories move onto this action in follow-up pull requests, once it exists on
mainfor them to address.Closes #3