From f5a2e62253229ffca1bc06e2a2e3ec8a64bf642f Mon Sep 17 00:00:00 2001 From: admin Date: Fri, 14 Aug 2026 12:37:20 -0500 Subject: [PATCH] fix(hybrid-gate): make the inline attribution pattern a superset The embedded ai-attribution job hardcodes its regex while the standalone no-ai-attribution.yml reads the caller's pattern file, so the two enforce the same policy from different sources and the embedded one is weaker. Against a real caller's pattern file it missed moonshot, openai, a second robot glyph, and the product URL. Two markers were missed by both, found by reading what the harness emits: the Claude-Session trailer key, which sits beside rather than inside the co-authored-by line, and a bare session URL on its own line -- that line carries neither glyph nor generated-with text, so scrubbing the line above it leaves this one standing. Direction matters here: deleting a repo's local copy in favour of the shared job would have REDUCED coverage, because the local copy is a superset rather than a duplicate. The shared floor rises first. Verified against both directions: 8 of 8 real markers matched, and 4 of 4 legitimate prose lines still ignored, including one discussing a co-authored-by trailer. The line-anchoring that makes that work is preserved. --- .github/workflows/hybrid-gate.yml | 18 +++++++++++++++++- 1 file changed, 17 insertions(+), 1 deletion(-) diff --git a/.github/workflows/hybrid-gate.yml b/.github/workflows/hybrid-gate.yml index b9d8ba1..ee1027f 100644 --- a/.github/workflows/hybrid-gate.yml +++ b/.github/workflows/hybrid-gate.yml @@ -468,7 +468,23 @@ jobs: # WHY line-anchored: PR bodies may legitimately discuss the policy in # prose (e.g. quoting "Co-authored-by: Claude …"). Only trailer-shaped # lines and explicit generated-with/robot markers are enforcement targets. - pattern='^(co-authored-by:.*(claude|gpt|codex|kimi|gemini|anthropic)|🤖|generated with)' + # + # WHY these specific alternates, each from an observed marker rather + # than from guessing at vendor names: + # moonshot / openai -- vendor names a co-authored-by trailer uses + # that the claude/gpt/codex/kimi/gemini/ + # anthropic set does not cover. + # 🧠 -- a second robot-class glyph seen alongside 🤖. + # claude-session: -- a trailer key emitted next to, not inside, + # the co-authored-by line, so the trailer + # alternate above never sees it. + # https://claude.(ai|com)/ + # -- the session and product URLs, which appear + # on their OWN line beneath the generated-with + # line. That line carries no 🤖 and no + # "generated with", so stripping the marker + # line above it left this one standing. + pattern='^(co-authored-by:.*(claude|gpt|codex|kimi|moonshot|gemini|anthropic|openai)|claude-session:|🤖|🧠|generated with|https://claude\.(ai|com)/)' violation=0 title_hits=$(printf '%s\n' "$PR_TITLE" | grep -inE "$pattern" || true)