mirror of
https://github.com/yeasy/docker_practice.git
synced 2026-08-10 08:27:25 +00:00
yeasy
1e56295251
An audit found the guard could miss commits it exists to catch. 1. SIGPIPE. Three inner checks used `printf ... | grep -q` under `set -euo pipefail`. When grep -q matches early it exits, printf dies of SIGPIPE, pipefail turns the pipeline non-zero, the `if` goes false, and the offending commit is silently not reported — the guard then prints its success line. This file already documents the hazard in a comment and had fixed it for the two outer pre-filters; the three inner ones were left as pipes. Now here-strings, like the rest. Demonstrated on a synthetic revert-style commit (an AI trailer quoted near the top, then a 200KB body): the pipe form MISSES it, the here-string form detects it. A trailer in the conventional last position happens to survive the pipe form, because grep must read to the end before matching — which is why this never showed up in practice. 2. `chatgpt` was in BAD_NAME and BAD_ANY but not BAD_TRAILER, so a Co-authored-by naming ChatGPT with an email outside anthropic.com/openai.com was not caught. Confirmed by test, then added. Verified before pushing this time: the amended script flags an AI-authored commit, a large-body early trailer, and a ChatGPT trailer, and scans claude_guide's full 345-commit history with zero false positives — that repo has 46 commits with Claude or Anthropic in the subject, none of which are identity or trailer hits.