🏗️🔧：refuse a sign-off that names a tool

[DerekNonGeneric]

Requested by DerekNonGeneric

Before: this repository carries its own copy of build/shared/commit-message.mts
rather than importing it, so the hole fixed in OpenINF/.github#924 was open here
too. An agent committing under its own git identity is the author of what it
commits, -s copies that identity into the sign-off, and checkSignOff — which
only asks whether the sign-off matches the author — found the two in agreement.
pnpm run lint:commits passed a commit whose Developer Certificate of Origin
had been certified by a program.

After: a Signed-off-by: naming an assistant or a bot account is refused
whoever the author is, by the same pattern that already refuses one as a
co-author. An agent-authored commit now has no spelling that lands: sign off as
itself and the trailer names a tool, sign off as anybody else and it is not the
author.

How: a straight port of OpenINF/.github#924. TOOL_COAUTHOR becomes
TOOL_IDENTITY and is applied to Signed-off-by as well as Co-authored-by,
in checkTrailers rather than in checkSignOff, so the rule also covers the
message the commit queue validates before landing. [bot] is read where an
account name ends, so it cannot match inside a person's name — a false positive
there would block a sign-off, which unlike a co-author credit cannot be dropped.
The same seven tests come with it. CONTRIBUTING.md gains the sentence the hole
was made of — the author of a commit has to be a person, and an agent committing
on somebody's behalf commits as them.

All three repositories — this one, OpenINF/.github and
OpenINF/openinf.github.io — carry a byte-identical copy of this file, and
nothing syncs them. They are identical again, which is worth keeping in mind
when any of them is next touched. OpenINF/openinf.github.io#1907 is the third.

Verified with node --test build/shared/*.test.mts (94 pass),
pnpm run lint:format, lint:md, lint:spelling, lint:types and
lint:commits on this branch.

Summary by CodeRabbit

• Documentation

  • Updated commit-message guidance to distinguish agent-authored commits from commits made on behalf of a person.
  • Clarified when to use Assisted-by:, Signed-off-by:, and Co-authored-by: trailers.

• Bug Fixes

  • Improved validation to reject bot and tool identities in person-only trailers.
  • Ensured sign-offs identify the commit author, while agent contributions use Assisted-by:.
  • Improved handling of bot-account suffixes and folded email addresses.

• Tests

  • Added coverage for assistant, bot, folded-address, self-signing, and human sign-off scenarios.

[coderabbitai]

Navigate logical layers of code changes, visualize relationships, and explore their blast radius.

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Essentials

Run ID: 9e567fcd-fc98-4779-99f0-3ebca5301034

📥 Commits

Reviewing files that changed from the base of the PR and between a0db68e and 4052636.

📒 Files selected for processing (2)

• build/shared/commit-message.mts
• build/shared/commit-message.test.mts

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

Commit trailer guidance and validation now distinguish agent and bot identities from human identities. Tool identities are rejected in both Co-authored-by: and Signed-off-by: trailers. Tests cover assistant, bot, folded-address, author-mismatch, and valid human sign-offs.

Changes

Commit trailer validation

Layer / File(s)	Summary
Identity rules and contributor guidance CONTRIBUTING.md, build/shared/commit-message.mts	The identity matcher now applies to co-author and sign-off trailers. Contributor guidance documents agent-authored and delegated commit rules.
Sign-off enforcement and tests build/shared/commit-message.mts, build/shared/commit-message.test.mts	Signed-off-by: values that match tool or bot identities are rejected. Tests cover assistant, bot, folded-address, author-mismatch, and valid human sign-offs.

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~15 minutes

Change: Bug fix

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly describes the main change: rejecting Signed-off-by trailers that name a tool. The emoji and separator add noise, but the title remains specific and understandable.
Docstring Coverage	✅ Passed	Docstring coverage is 100.00% which is sufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 1 functions across 2 files.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}