GeezerVison

What

The AI rules read only the commit message. So a commit authored by the agent itself, with the person at most a Co-authored-by: line, passed both forbid and disclose. Projects that adopted forbid have written policies such as "commits must be authored by you" and "AI tools must not be listed as commit authors or co-authors". Those policies were not enforced for this case.

New rule CC017 ai-author reads the author of the commit under test. It judges the author exactly as the same identity on a Co-authored-by: line, so the two checks can never disagree about who is a tool.

• Built under both forbid and disclose. Under disclose, CC015 already refuses the tool as a co-author, and the author slot takes a person's place even more.
• A project that accepts agent-authored commits can list CC017 under warn.
• ignore_authors skips it like the other commit rules.
• Existing commit (--rev, or HEAD): reads the recorded author.
• Message not yet committed (commit-msg hook, piped message, api.validate_message, the MCP validate_message tool): reads the author git would record, via git var GIT_AUTHOR_IDENT. That honours GIT_AUTHOR_NAME / GIT_AUTHOR_EMAIL the way git commit does, which is how Aider commits as <name> (aider). It fires only when that identity is an AI tool, which is exactly when the commit about to be made would be authored by one. With no identity at all, nothing is flagged.

It also adds the GitHub App identities of Claude (claude[bot]), Cursor's background agent (cursor[bot]), Codex cloud (chatgpt-codex-connector[bot]) and Amazon Q Developer (amazon-q-developer[bot]). The App already checks commits from these accounts; now they also count as co-authors.

ignore_authors on a piped message now takes GIT_AUTHOR_NAME before user.name, the same order git uses. Without the variable, nothing changes. With it, a piped message is judged by the author it names. commit-check-action#321 uses this to hand over each pull request commit's author.

Before / after

Commit message Fix parser crash + Co-authored-by: Jane Dev <[email protected]>, checked with commit-check -m --rev <sha>:

CC017 ai-author check failed ==> devin-ai-integration[bot] <158243242+devin-ai-integration[bot]@users.noreply.github.com>
An AI tool is the commit author: Devin
Suggest: Author the commit yourself: git commit --amend --reset-author, and disclose the tool with "Assisted-by: Devin"
Docs: https://commit-check.com/rules/#cc017

Under forbid, the suggestion stops after --reset-author.

Piped message, ignore_authors = ["Renovate Bot"], GIT_AUTHOR_NAME=Renovate Bot: before, the message was checked under the runner's user.name. After, it is skipped.

False positives

I ran the detector over every author in junit-framework's last 3,000 commits (93 identities, including renovate, dependabot, github-actions and pre-commit-ci) and over this org's repos: no matches.

Checks

pytest: 1563 passed, 100% line and branch coverage. The one failure, test_load_config_file_permission_error, also fails on main when run as root. ruff check and ruff format are clean.

TestFixOption now pins GIT_AUTHOR_NAME/GIT_AUTHOR_EMAIL, because on a machine whose git identity is an agent, the pending author is an AI tool. The README rule table now says CC013–CC017.

The site's rules page needs a CC017 section. It goes in the release docs PR, because commit-check.com documents released behaviour only.