pr-author-check.yml

name: PR Author Check

on:
  pull_request:
    types: [opened, synchronize, reopened]

jobs:
  validate-authors:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
      contents: read

    steps:
      - name: Validate commit authors
        uses: actions/github-script@v7
        with:
          script: |
            const allowedBots = [
              'github-actions[bot]',
              'dependabot[bot]'
            ];

            // Fetch all commits in the PR
            const { data: commits } = await github.rest.pulls.listCommits({
              owner: context.repo.owner,
              repo: context.repo.repo,
              pull_number: context.issue.number,
            });

            const violations = [];

            for (const commit of commits) {
              const message = commit.commit.message;
              const sha = commit.sha.substring(0, 7);
              
              // Extract Co-authored-by lines
              const coAuthorRegex = /^Co-authored-by:\s*(.+?)\s*<(.+?)>/gim;
              let match;
              
              while ((match = coAuthorRegex.exec(message)) !== null) {
                const name = match[1].trim();
                const email = match[2].trim();
                
                // Check if this is a bot account
                if (name.endsWith('[bot]')) {
                  // Verify it's in the allowlist
                  if (!allowedBots.includes(name)) {
                    violations.push({
                      sha: sha,
                      name: name,
                      email: email
                    });
                  }
                }
                // Human accounts (no [bot] suffix) are always allowed
              }
            }

            if (violations.length > 0) {
              const errorReport = violations.map(v => 
                `  - Commit ${v.sha}: ${v.name} <${v.email}>`
              ).join('\n');
              
              core.setFailed(
                `❌ Unauthorized bot co-authors detected:\n\n${errorReport}\n\n` +
                `Only human accounts and the following bot accounts are permitted as co-authors:\n` +
                `  - ${allowedBots.join('\n  - ')}\n\n` +
                `Please remove unauthorized co-authors from your commits using:\n` +
                `  git rebase -i HEAD~<n>  # Edit commits\n` +
                `  git commit --amend      # Modify commit message\n` +
                `  git push --force        # Update PR`
              );
            } else {
              console.log('✅ All commit authors validated successfully');
            }