fix(#2236): reject Signed-off-by trailers in agent commits - #2240
Conversation
Agents sometimes produce Signed-off-by trailers via `git commit -s`, causing gitlint body-max-line-length failures because the bot noreply email makes the trailer ~90 characters. DCO sign-off is a human attestation of personhood — agents are not people, and the DCO app already waives the check for bot authors (#1449). Changes: - SKILL.md: add prominent prohibition against `git commit -s` and Signed-off-by trailers in the commit section (step 10b) - post-code.sh: add section 3b that scans agent commits for Signed-off-by trailers and exits non-zero if found - post-fix.sh: add section 2b with the same trailer check - post-code-test.sh: add 5 test cases covering trailer detection (present, absent, empty body, mid-line mention, mixed trailers) Note: `make lint` could not run due to network restrictions preventing shellcheck installation. All scripts pass `bash -n` syntax checking and the test suite (51 tests). Closes #2236
E2E tests did not runE2E tests run automatically for org/repo members and collaborators on pull requests. For other contributors, a maintainer must add the See E2E testing guide for details. |
Site previewPreview: https://68d4dbf4-site.fullsend-ai.workers.dev Commit: |
|
🤖 Finished Review · ✅ Success · Started 4:04 PM UTC · Completed 4:16 PM UTC |
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
ReviewFindingsLow
Previous runReviewFindingsMedium
Low
Info
|
fullsend-ai-review
Bot
added
the
requires-manual-review
|
/fs-fix fix the medium and low findings from fullsend-ai-review |
|
🤖 Finished Fix · ✅ Success · Started 5:08 PM UTC · Completed 5:14 PM UTC |
- Add Signed-off-by prohibition to fix-review/SKILL.md (incomplete-scope) - Add variant-casing test to confirm case-sensitive matching (test-adequacy) - Align success messages to em-dash pattern (success-message-consistency) Addresses review feedback on #2240
🔧 Fix agent — iteration 1 (human-triggered)Addressed 3 of 4 medium/low findings. Fixed incomplete-scope (added prohibition to fix-review SKILL.md), test-adequacy (added case-sensitivity test), and success-message-consistency (em-dash pattern). Disagreed with policy-contradiction because AGENTS.md is a protected path. Fixed (3):
Disagreed (1):
Tests: passed Updated by fullsend fix agent |
|
🤖 Finished Review · ✅ Success · Started 5:18 PM UTC · Completed 5:29 PM UTC |
![fullsend-ai-review[bot]](https://avatars.githubusercontent.com/in/3478501?s=60&v=4){kind=small}
| # Test helper — reimplements the Signed-off-by trailer detection logic from | ||
| # post-code.sh section 3b. Given commit body text, returns whether the | ||
| # trailer was detected. | ||
| # --------------------------------------------------------------------------- |
There was a problem hiding this comment.
[low] test-adequacy
The test helper reimplements detection with echo | grep rather than git log | grep, so multi-commit ranges are untested. The production code runs git log which concatenates multiple commit bodies. A test with two simulated commit bodies (one clean, one with the trailer) concatenated with a newline would increase confidence.
| This is not a repeat of 9a — it scans what you *actually staged*, which may | ||
| differ from what you named. If the scan fails, do not commit. | ||
|
|
||
| **NEVER use `git commit -s` or add `Signed-off-by` trailers.** DCO is a |
There was a problem hiding this comment.
[low] policy-contradiction
The fullsend repo AGENTS.md (line 15) mandates DCO sign-off for all commits (git commit -s), while this PR adds a prohibition against sign-off in the scaffold template. These govern different contexts (fullsend repo vs. scaffolded target repos), and CONTRIBUTING.md explicitly exempts autonomous bot commits, so there is no operational conflict. Consider updating AGENTS.md to note the autonomous-agent exemption for clarity.
There was a problem hiding this comment.
Retro should file an issue to clarify our own AGENTS.md to provide DCO for all human-proposed commits. Commits authored and proposed entirely by fullsend agent bots are exempt from this requirement.
fullsend-ai-review
Bot
added
ready-for-merge
|
🤖 Finished Retro · ✅ Success · Started 6:27 PM UTC · Completed 6:36 PM UTC |
Retro: PR #2240 — reject Signed-off-by trailers in agent commitsTimeline: Issue #2236 → triage (15:45) → code (15:51) → PR opened (16:00) → review 1 (16:01–16:16, 2 medium + 2 low + 1 info) → human triggers What went well:
Proposals:
Skipped proposals:
Proposals filed
|
… commits The DCO bullet in AGENTS.md mandated sign-off for all commits without distinguishing human from bot authorship. This contradicted CONTRIBUTING.md, which already exempts autonomous agent commits. The review agent flagged this policy contradiction during PR fullsend-ai#2240 and a human reviewer requested a clarification issue. Update the DCO bullet to mirror the CONTRIBUTING.md language: human-proposed commits must sign off, human-driven agent sessions should sign off, and autonomous agent commits are exempt because the DCO is a human attestation that no one is present to make in an autonomous session. Note: make lint could not run (shellcheck download blocked by sandbox network policy). This is a docs-only change with no code to test. Closes fullsend-ai#2252
1 participant
Agents sometimes produce Signed-off-by trailers via
git commit -s, causing gitlint body-max-line-length failures because the bot noreply email makes the trailer ~90 characters. DCO sign-off is a human attestation of personhood — agents are not people, and the DCO app already waives the check for bot authors (#1449).Changes:
git commit -sandSigned-off-by trailers in the commit section (step 10b)
Signed-off-by trailers and exits non-zero if found
(present, absent, empty body, mid-line mention, mixed trailers)
Note:
make lintcould not run due to network restrictions preventing shellcheck installation. All scripts passbash -nsyntax checking and the test suite (51 tests).Closes #2236
Post-script verification
agent/2236-no-signed-off-by)c8e6c3aa99fb9d77e1330857bcc88be43eb415bd..HEAD)