From 3458b2f2e5173b1598c0b59f056c7c7d502c7edb Mon Sep 17 00:00:00 2001
From: Andrey Antukh <niwi@niwi.nz>
Date: Wed, 14 Oct 2026 12:16:30 +0000
Subject: [PATCH] :wrench: Run check-commit on every new commit in CI

Add a check-commit-guidelines job to commit-checker.yml
that runs scripts/check-commit on every new commit, so
the Co-authored-by ban holds in CI too. PR events check
out the base ref, keeping the executed script trusted.

AI-assisted-by: muse-spark-1.3-contributor
Signed-off-by: Andrey Antukh <niwi@niwi.nz>
---
 .github/workflows/commit-checker.yml          | 41 +++++++++++++++++++
 .serena/memories/workflow/creating-commits.md |  1 +
 CONTRIBUTING.md                               |  2 +
 3 files changed, 44 insertions(+)

diff --git a/.github/workflows/commit-checker.yml b/.github/workflows/commit-checker.yml
index a80e6e4cc0..14c48a5850 100644
--- a/.github/workflows/commit-checker.yml
+++ b/.github/workflows/commit-checker.yml
@@ -50,4 +50,45 @@ jobs:
       #     pattern: '^.+(Resolves|Fixes): \#[0-9]+$'
       #     error: 'You need at least one "Resolves|Fixes: #<issue number>" line.'
 
+  check-commit-guidelines:
+    if: ${{ !github.event.pull_request.draft }}
+    name: Check Commit Guidelines
+    runs-on: ubuntu-latest
+    steps:
+      # On PR events check out the base ref, so the script below is
+      # always the trusted version: PR commits are only read, never
+      # executed. On push events this resolves to the pushed sha.
+      - name: Checkout trusted code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          ref: ${{ github.event.pull_request.base.sha || github.sha }}
+
+      - name: Fetch PR commits
+        if: ${{ github.event_name == 'pull_request' || github.event_name == 'pull_request_target' }}
+        run: git fetch --no-tags origin "pull/${{ github.event.pull_request.number }}/head:pr-head"
+
+      - name: Run scripts/check-commit on every new commit
+        run: |
+          set -euo pipefail
+          if [ "${{ github.event_name }}" = "push" ]; then
+            if [ "${{ github.event.before }}" = "0000000000000000000000000000000000000000" ]; then
+              RANGE="${{ github.sha }}"
+            else
+              RANGE="${{ github.event.before }}..${{ github.sha }}"
+            fi
+          else
+            RANGE="${{ github.event.pull_request.base.sha }}..pr-head"
+          fi
+          COMMITS="$(git rev-list --reverse "$RANGE")"
+          if [ -z "$COMMITS" ]; then
+            echo "No new commits to check."
+            exit 0
+          fi
+          FAILED=0
+          for COMMIT in $COMMITS; do
+            ./scripts/check-commit -c "$COMMIT" || FAILED=1
+          done
+          exit "$FAILED"
+
 
diff --git a/.serena/memories/workflow/creating-commits.md b/.serena/memories/workflow/creating-commits.md
index d2d1fcaac2..a60234819f 100644
--- a/.serena/memories/workflow/creating-commits.md
+++ b/.serena/memories/workflow/creating-commits.md
@@ -38,6 +38,7 @@ that breaks them is wrong, even if the code is right.
 - **NEVER** hand-wave the body as "one long line". If a line exceeds 76,
   break it at a space.
 - **NEVER add a `Co-authored-by:` trailer.** It is forbidden; `scripts/check-commit` fails the commit when any line matches it (case-insensitive).
+- CI runs `scripts/check-commit` on every new commit (`mem:workflow/creating-commits` is enforced by `.github/workflows/commit-checker.yml`), so a forbidden trailer fails the build.
 - Exceptions inside the body (do not wrap these): `Signed-off-by:`,
   `AI-assisted-by:` trailers, and lines carrying a URL.
 
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 1b74634dc7..2d665b0715 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -227,6 +227,8 @@ Commit messages must follow this format:
   `./scripts/check-commit`
 
 You can check a commit against these rules with `./scripts/check-commit`.
+CI runs the same script on every new commit in
+`.github/workflows/commit-checker.yml`, so violations fail the build.
 
 ### Examples