feat: check each pull request commit as itself

Each PR commit's message was piped to the CLI, so the CLI never saw the
commit's author: ignore_authors compared the runner's git identity or the
merge commit's author, and an author-based rule had nothing to read.

A commit the clone holds is now checked by its hash (--message --rev),
so the CLI reads that commit's message and its own author. A commit
listed only by the API (the default shallow checkout, or no checkout at
all) is still piped in, with the author the API recorded passed as
GIT_AUTHOR_NAME / GIT_AUTHOR_EMAIL, which is where the CLI reads the
author of a message that has no commit.

Author: shenxianpeng

main.py

@@ -489,6 +489,10 @@ def get_messages_from_head_ref(base_ref: str) -> list[Commit]:
 #: The most commits GitHub's pull request commits endpoint returns.
 API_COMMIT_LIMIT = 250
 
+#: Author (name, email) of each commit listed by the API, by hash. Those
+#: commits are not in the clone, so this is the only record of who wrote them.
+API_AUTHORS: dict[str, tuple[str, str]] = {}
+
 
 def get_messages_from_api() -> list[Commit]:
     """The pull request's commits from the REST API, for a clone without them.
@@ -509,7 +513,12 @@ def get_messages_from_api() -> list[Commit]:
     pull = (
         Github(auth=Auth.Token(token), base_url=api_url).get_repo(repo).get_pull(number)
     )
-    commits = [(c.sha, c.commit.message) for c in pull.get_commits()]
+    listed = list(pull.get_commits())
+    commits = [(c.sha, c.commit.message) for c in listed]
+    for c in listed:
+        author = c.commit.author
+        if author is not None:
+            API_AUTHORS[c.sha] = (author.name or "", author.email or "")
     # A force push after the event can leave the same count but other commits.
     head = get_pr_head_sha()
     if len(commits) != total or (head and commits[-1][0] != head):
@@ -578,7 +587,9 @@ def _relay_cli_notices(text: str) -> None:
 
 
 def run_check_json(
-    args: list[str], input_text: str | None = None
+    args: list[str],
+    input_text: str | None = None,
+    env: dict[str, str] | None = None,
 ) -> tuple[int, dict[str, Any] | None, str]:
     """Run ``commit-check --format json`` and return (exit code, parsed JSON, raw output).
 
@@ -602,6 +613,7 @@ def run_check_json(
         text=True,
         encoding="utf-8",
         check=False,
+        env={**os.environ, **env} if env else None,
     )
     out = result.stdout or ""
     err = result.stderr or ""
@@ -621,28 +633,45 @@ def run_check_json(
 
 
 def check_scope(
-    label: str, args: list[str], input_text: str | None = None, sha: str = ""
+    label: str,
+    args: list[str],
+    input_text: str | None = None,
+    sha: str = "",
+    env: dict[str, str] | None = None,
 ) -> ScopeResult:
     """Run commit-check for one scope and wrap the outcome in a ScopeResult.
 
     ``sha`` names the commit a message scope checked; it rides along on both
     outcomes so an unparsable CLI response still says which commit it was.
     """
-    _rc, data, raw = run_check_json(args, input_text=input_text)
+    _rc, data, raw = run_check_json(args, input_text=input_text, env=env)
     if isinstance(data, dict):
         return ScopeResult(label=label, checks=data.get("checks", []), sha=sha)
     return ScopeResult(label=label, raw_text=raw, sha=sha)
 
 
 def run_pr_message_checks(pr_commits: list[Commit]) -> list[ScopeResult]:
-    """Check each PR commit message individually via commit-check --message."""
+    """Check each PR commit individually via commit-check --message.
+
+    A commit the clone holds is checked by its hash (``--rev``), so the CLI
+    reads its message and its own author: the AI author rule (CC017) and
+    ``ignore_authors`` then judge that commit's author, not whoever HEAD or
+    the runner's git config names. A commit listed only by the API is piped
+    in, with the author the API recorded passed as git's author variables.
+    """
     results: list[ScopeResult] = []
     total = len(pr_commits)
     for index, (sha, msg) in enumerate(pr_commits, start=1):
+        label = f"Commit {index}/{total}"
+        if sha and _rev_resolves(sha):
+            results.append(check_scope(label, ["--message", "--rev", sha], sha=sha))
+            continue
+        env = None
+        if sha in API_AUTHORS:
+            name, email = API_AUTHORS[sha]
+            env = {"GIT_AUTHOR_NAME": name, "GIT_AUTHOR_EMAIL": email}
         results.append(
-            check_scope(
-                f"Commit {index}/{total}", ["--message"], input_text=msg, sha=sha
-            )
+            check_scope(label, ["--message"], input_text=msg, sha=sha, env=env)
         )
     return results
 

main_test.py

@@ -390,6 +390,45 @@ def test_invalid_json_falls_back_to_raw_text(self):
 
 
 class TestRunPrMessageChecks(unittest.TestCase):
+    """Commits the clone lacks are piped in; the rest are checked by hash."""
+
+    def setUp(self):
+        resolves = patch("main._rev_resolves", return_value=False)
+        resolves.start()
+        self.addCleanup(resolves.stop)
+        main.API_AUTHORS.clear()
+        self.addCleanup(main.API_AUTHORS.clear)
+
+    def test_a_commit_in_the_clone_is_checked_by_its_hash(self):
+        """The CLI then reads that commit's own author (CC017, ignore_authors)."""
+        mock_result = MagicMock(returncode=0, stdout=json_output(make_check("message")))
+        with (
+            patch("main._rev_resolves", return_value=True),
+            patch("main.subprocess.run", return_value=mock_result) as mock_run,
+        ):
+            scopes = main.run_pr_message_checks([(SHA_A, "fix: something")])
+        self.assertEqual(scopes[0].status, "pass")
+        self.assertEqual(scopes[0].sha, SHA_A)
+        self.assertEqual(
+            mock_run.call_args[0][0],
+            ["commit-check", "--format", "json", "--message", "--rev", SHA_A],
+        )
+        self.assertIsNone(mock_run.call_args[1]["input"])
+        self.assertIsNone(mock_run.call_args[1]["env"])
+
+    def test_an_api_listed_commit_carries_its_author(self):
+        """No commit to read, so the API's author goes in git's variables."""
+        main.API_AUTHORS[SHA_A] = ("google-labs-jules[bot]", "jules@example.com")
+        mock_result = MagicMock(returncode=0, stdout=json_output(make_check("message")))
+        with patch("main.subprocess.run", return_value=mock_result) as mock_run:
+            main.run_pr_message_checks([(SHA_A, "fix: something")])
+        self.assertEqual(mock_run.call_args[1]["input"], "fix: something")
+        env = mock_run.call_args[1]["env"]
+        self.assertEqual(env["GIT_AUTHOR_NAME"], "google-labs-jules[bot]")
+        self.assertEqual(env["GIT_AUTHOR_EMAIL"], "jules@example.com")
+        # The rest of the environment is kept: PATH finds the CLI.
+        self.assertEqual(env.get("PATH"), os.environ.get("PATH"))
+
     def test_single_message_pass(self):
         mock_result = MagicMock(returncode=0, stdout=json_output(make_check("message")))
         with patch("main.subprocess.run", return_value=mock_result) as mock_run:
@@ -1158,9 +1197,17 @@ class TestGetMessagesFromApi(unittest.TestCase):
     def _run(self, total, api_commits, head="b2"):
         pull = MagicMock()
         pull.get_commits.return_value = [
-            MagicMock(sha=sha, commit=MagicMock(message=msg))
+            MagicMock(
+                sha=sha,
+                commit=MagicMock(
+                    message=msg,
+                    author=MagicMock(email=f"{sha}@example.com"),
+                ),
+            )
             for sha, msg in api_commits
         ]
+        for listed in pull.get_commits.return_value:
+            listed.commit.author.name = f"author {listed.sha}"
         github_module = MagicMock()
         github_module.Github.return_value.get_repo.return_value.get_pull.return_value = pull
         env = {
@@ -1185,6 +1232,37 @@ def test_lists_the_commits_oldest_first(self):
             "https://ghe.example.com/api/v3",
         )
 
+    def test_records_each_commit_author(self):
+        main.API_AUTHORS.clear()
+        self.addCleanup(main.API_AUTHORS.clear)
+        self._run(2, [("a1", "feat: one"), ("b2", "fix: two")])
+        self.assertEqual(
+            main.API_AUTHORS,
+            {
+                "a1": ("author a1", "a1@example.com"),
+                "b2": ("author b2", "b2@example.com"),
+            },
+        )
+
+    def test_a_commit_without_an_author_records_nothing(self):
+        main.API_AUTHORS.clear()
+        self.addCleanup(main.API_AUTHORS.clear)
+        pull = MagicMock()
+        pull.get_commits.return_value = [
+            MagicMock(sha="b2", commit=MagicMock(message="fix: two", author=None))
+        ]
+        github_module = MagicMock()
+        github_module.Github.return_value.get_repo.return_value.get_pull.return_value = pull
+        env = {"GITHUB_TOKEN": "token", "GITHUB_REPOSITORY": "owner/repo"}
+        with (
+            patch.dict(os.environ, env),
+            patch("main.get_pr_event", return_value={"number": 7, "commits": 1}),
+            patch("main.get_pr_head_sha", return_value="b2"),
+            patch.dict(sys.modules, {"github": github_module}),
+        ):
+            self.assertEqual(main.get_messages_from_api(), [("b2", "fix: two")])
+        self.assertEqual(main.API_AUTHORS, {})
+
     def test_a_list_that_ends_elsewhere_is_not_used(self):
         # A force push after the event: same count, other commits.
         result, _ = self._run(2, [("a1", "feat: one"), ("c3", "fix: other")])