@avi2dg/checks 0.68.1 → 0.68.2

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.68.2
+
+Released 2026-11-06.
+
+### Fixes
+
+- **commit-identity:** accept Dependabot bot identity on Dependabot titles [#53](https://github.com/avi2d/checks/pull/53)
+
 ## 0.68.1
 
 Released 2026-11-06.

package/commitlint.config.ts

@@ -14,7 +14,9 @@ const dependabot = new RegExp(
   String.raw`^build\(deps(?:-dev)?\): (?:${single}|${bumpTo}|${joint}|${byName}|${requirement}|${inGroup}|${groupWithUpdates})(?: \(#\d+\))?$`,
 );
 
+export const isDependabotTitle = (title: string): boolean => dependabot.test(title);
+
 export default {
   extends: ["@commitlint/config-conventional"],
-  ignores: [(message: string) => dependabot.test(message)],
+  ignores: [isDependabotTitle],
 };

package/docs/gates/checks-commit-identity.md

@@ -17,6 +17,11 @@ The same author on a commit with any other committer must match the allowed name
 `github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>` is allowed as author only of a commit whose subject is `chore: release <version>`, with or without the pull request number a squash merge adds.
 GitHub attributes the release commit [checks-release-pr](checks-release-pr.md) or [checks-release-push](checks-release-push.md) makes to that bot, since each commits through the workflow token.
 Such a commit may carry a `Co-authored-by` trailer naming that bot, since GitHub adds one to some squash merges of a pull request the bot opened, and every other trailer is refused.
+A Dependabot-titled commit may carry a `Co-authored-by` trailer naming `dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>`, since GitHub adds one when the owner squash-merges a pull request the bot opened, and every other trailer is refused.
+`dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>` is allowed as author only of a commit whose subject is a Dependabot title [the commit message lint](../configs/commit-messages.md) exempts, with or without the pull request number a squash merge adds.
+Dependabot writes that commit itself, and GitHub commits it as `GitHub <noreply@github.com>`, which the gate already allows as committer.
+This identity matches by name and email, even on a commit GitHub made, so the Dependabot address under another name is refused.
+Its `Signed-off-by` trailer is not a `Co-authored-by` trailer, so the gate does not read it.
 
 ## What it reads
 
@@ -52,6 +57,9 @@ commit-identity: 1 of 1 commit(s) in HEAD carry a foreign identity:
   79fa94f9f027 feat: foreign
     author someone <someone@example.com>
   allowed: Repo Owner <owner@example.com>
+  allowed as committer only: GitHub <noreply@github.com>, which also lets an allowed email author under any name
+  allowed as release author only: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
+  allowed as Dependabot author only, on a Dependabot title: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 ```
 
 ## When it runs

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.68.1",
+  "version": "0.68.2",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "author": {
     "name": "avi2d",

package/src/delivery/commit-identity.ts

@@ -1,5 +1,6 @@
 #!/usr/bin/env bun
 import { Console, Effect, FileSystem, Path, Schema } from "effect";
+import { isDependabotTitle } from "../../commitlint.config.ts";
 import { releasedVersionOf } from "./release.ts";
 import { git, refArgs } from "../core/git.ts";
 import { runMain } from "../core/main.ts";
@@ -23,11 +24,13 @@ const SQUASH_COMMITTER: Identity = { name: "GitHub", email: "noreply@github.com"
 // GitHub may also name that bot as co-author when it squashes the pull request the bot opened.
 const RELEASE_AUTHOR: Identity = { name: "github-actions[bot]", email: "41898282+github-actions[bot]@users.noreply.github.com" };
 
+const DEPENDABOT_AUTHOR: Identity = { name: "dependabot[bot]", email: "49699333+dependabot[bot]@users.noreply.github.com" };
+
 const CO_AUTHOR = /^co-authored-by:\s*(.*?)\s*<([^<>]*)>\s*$/i;
 
-function namesReleaseAuthor(trailer: string): boolean {
+function namesCoAuthor(identity: Identity, trailer: string): boolean {
   const [, name, email = ""] = CO_AUTHOR.exec(trailer) ?? [];
-  return name !== undefined && allows([RELEASE_AUTHOR], { name, email });
+  return name !== undefined && allows([identity], { name, email });
 }
 
 // git's own trailer parser, so only the trailer block counts and prose never does.
@@ -130,14 +133,19 @@ function inspect(commit: Commit, allowed: readonly Identity[]): Offence | undefi
   const release = releasedVersionOf(commit.subject) !== undefined;
   const authors = release ? [...allowed, RELEASE_AUTHOR] : allowed;
   const madeByGitHub = allows([SQUASH_COMMITTER], commit.committer);
-  if (!(madeByGitHub ? allowsEmail(authors, commit.author) : allows(authors, commit.author))) {
+  const authored = madeByGitHub ? allowsEmail(authors, commit.author) : allows(authors, commit.author);
+  // Outside the author list, which a GitHub-made commit matches by email alone and so would take any name on the bot's address.
+  const dependabotTitle = isDependabotTitle(commit.subject);
+  const dependabot = dependabotTitle && allows([DEPENDABOT_AUTHOR], commit.author);
+  if (!authored && !dependabot) {
     reasons.push(`author ${render(commit.author)}`);
   }
   if (!allows([...allowed, SQUASH_COMMITTER], commit.committer)) {
     reasons.push(`committer ${render(commit.committer)}`);
   }
   for (const trailer of commit.coAuthoredBy) {
-    if (release && namesReleaseAuthor(trailer)) continue;
+    if (release && namesCoAuthor(RELEASE_AUTHOR, trailer)) continue;
+    if (dependabotTitle && namesCoAuthor(DEPENDABOT_AUTHOR, trailer)) continue;
     reasons.push(`trailer ${trailer}`);
   }
   return reasons.length === 0 ? undefined : { commit, reasons };
@@ -167,6 +175,7 @@ const check = Effect.gen(function* () {
     lines.push(`  allowed: ${allowed.map(render).join(", ")}`);
     lines.push(`  allowed as committer only: ${render(SQUASH_COMMITTER)}, which also lets an allowed email author under any name`);
     lines.push(`  allowed as release author only: ${render(RELEASE_AUTHOR)}`);
+    lines.push(`  allowed as Dependabot author only, on a Dependabot title: ${render(DEPENDABOT_AUTHOR)}`);
     yield* Console.error(lines.join("\n"));
     return false;
   }