docs: pin v2.20.5 and add its changelog entry

docs/changelog.md

@@ -11,6 +11,7 @@ page that documents it.
 
 | Version | What changed | Documented in |
 |---|---|---|
+| [2.20.5](#v2205) | The author checks cover a repository's first commit; a run takes about half the time to start; releases on PyPI carry provenance | [Checking the committer](example.md#checking-the-committer) · [CC017](rules.md#cc017) |
 | [2.20.3](#v2203) | Failures print a one-line header and an indented block per check, in place of the ASCII banner; an agent skill for coding agents | [Getting started](getting-started.md#2-watch-it-reject-something) · [With AI coding agents](guides/ai-agents.md#tell-the-agent) |
 | [2.20.1](#v2201) | `--ai-attribution-only` checks a pull request description against your AI policy; JSON lists the AI tools found; more AI marks recognised | [Checking a pull request description](guides/policies.md#checking-a-pull-request-description) · [CC013](rules.md#cc013) |
 | [2.20.0](#v2200) | Commits authored by an AI tool rejected; subject length `0` turns the rule off; Python 3.11+ required | [CC017](rules.md#cc017) · [CC013](rules.md#cc013) · [CC004](rules.md#cc004) |
@@ -39,6 +40,18 @@ page that documents it.
 | [2.5.0](#v250) | Organization-wide config with `inherit_from` | [Across an organization](guides/organization.md) |
 | [2.0.0](#v200) | Configuration moved from YAML to TOML — breaking | [Migrating from v1](migration.md) |
 
+## v2.20.5 (2026-11-11) { #v2205 }
+
+### Changed
+
+* A run takes about half the time to start: the AI signature patterns are compiled when first used. ([#693](https://github.com/commit-check/commit-check/pull/693))
+* Releases on PyPI carry provenance attestations. ([#691](https://github.com/commit-check/commit-check/pull/691))
+
+### Fixed
+
+* `--author-name` and `--author-email` check a repository's first commit, instead of being skipped until a commit exists. ([Checking the committer](example.md#checking-the-committer), [#692](https://github.com/commit-check/commit-check/pull/692))
+* CC017's advice for a message not yet committed names `author.name` and `author.email` among the settings to unset. ([CC017](rules.md#cc017), [#692](https://github.com/commit-check/commit-check/pull/692))
+
 ## v2.20.4 (2026-11-10) { #v2204 }
 
 ### Fixed

docs/compare/tools.md

@@ -65,7 +65,7 @@ Replace the hook:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-message
 ```

docs/configuration.md

@@ -274,7 +274,7 @@ Used from a hook definition, with no config file anywhere in the repository:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-message
         args:

docs/example.md

@@ -144,7 +144,9 @@ Without `--rev`, these validate the *local git config* — whoever is about to
 commit — falling back to `HEAD`'s author only when no identity is configured.
 The identity is read in git's order: `GIT_AUTHOR_NAME` and
 `GIT_AUTHOR_EMAIL` when set, then `author.name` and `author.email`, then
-`user.name` and `user.email`.
+`user.name` and `user.email`. From 2.20.5 on that identity is checked on a
+repository's first commit too; earlier versions skipped both checks until a
+commit existed.
 That is the right subject for a hook and the wrong one for CI: an existing
 commit's identity is a fact about the commit, not about the operator running
 the check. Add `--rev` and both checks read that commit's recorded author, and
@@ -167,7 +169,7 @@ pushed:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-no-force-push
         stages: [pre-push]

docs/guides/pre-commit.md

@@ -8,7 +8,7 @@ Add Commit Check to `.pre-commit-config.yaml`:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-message
       - id: check-branch
@@ -68,7 +68,7 @@ Options can be passed as hook arguments, which keeps everything in one file:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-message
         args:
@@ -90,7 +90,7 @@ colon, and lets the commit through:
 ```yaml title=".pre-commit-config.yaml"
 repos:
   - repo: https://github.com/commit-check/commit-check
-    rev: v2.20.4
+    rev: v2.20.5
     hooks:
       - id: check-message
         args: [--fix]

docs/rules.md

@@ -753,9 +753,8 @@ is, and it is what GitHub shows as the contributor.
 The commit fails even with a human `Co-authored-by:` line. When the message
 is checked before the commit exists, there is nothing to amend yet, so the
 suggestion is to set `user.name` and `user.email` to your own and to unset
-`GIT_AUTHOR_NAME` and `GIT_AUTHOR_EMAIL`. If `author.name` or `author.email`
-names the tool, unset those as well: they outrank `user.name` and
-`user.email`.
+`author.name`, `author.email`, `GIT_AUTHOR_NAME` and `GIT_AUTHOR_EMAIL` if a
+tool set them. All four outrank `user.name` and `user.email`.
 
 **Options**