From 67fcc63d4ade1eb4d0f042d76442b2829d7c42ce Mon Sep 17 00:00:00 2001 From: Roanny Lamas Date: Fri, 9 Oct 2026 17:59:25 -0300 Subject: [PATCH] ci: match the allowed commit authors as literals, not globs The unquoted case pattern 49699333+dependabot[bot]@... was a glob: [bot] matches one character of b, o or t, so Dependabot's real address failed the gate and a look-alike such as dependabotb@ passed. The three addresses are now quoted literals. Tested: the three allowed addresses pass; dependabotb@, dependabott@ and the employer address fail (operator-commit-author-gate). Co-Authored-By: Claude Opus 5.5 --- .github/workflows/ci.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f58c0b6..9dfed93 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -133,7 +133,9 @@ jobs: while read -r sha email; do [ -n "$sha" ] || continue case "$email" in - roannylamaslopez@gmail.com|49699333+dependabot[bot]@users.noreply.github.com|noreply@github.com) ;; + # Quoted: each address is a literal, not a glob (an unquoted + # `[bot]` would match one character of b, o or t). + 'roannylamaslopez@gmail.com'|'49699333+dependabot[bot]@users.noreply.github.com'|'noreply@github.com') ;; *) echo "::error::commit $sha is authored as $email, not roannylamaslopez@gmail.com"; fail=1 ;; esac done <<< "$log"