ci: reject commits authored by Claude or Copilot

[davecheney]

The earlier version also read commit messages and the PR description. That caused too much debate about which patterns to match, so this version starts small. It checks only the author and committer email of each commit. Co-authored-by trailers and PR text are not checked. We can add more checks in later PRs if we need them.

[davecheney]

@dgryski @jakebailey @deadprogram despite AGENTS.md, co-attribution commits do appear in PRs. This wastes maintainer bandwidth and additional cleanup work if they're not caught before merging -- of which I have been the most recent offender.

A job like this can automate the maintenance burden. In the future it could also be made a required build on the repo to prevent merges with co-attribution commits.

[deadprogram]

Thanks for adding this @davecheney. I ran the pattern on my local machine against a set of sample trailers and the full dev history, which has no matches. The following is edited from an automated review:

1. The pattern misses a few trailers that tools add, for example Assisted-by: Claude, Generated-by: Claude, Co-authored-by: Windsurf <noreply@windsurf.com> and Co-authored-by: Junie <junie@jetbrains.com>. Perhaps add assisted-by: and generated-by: and a few more tool names? A blocklist will always lag behind, so maybe just the common ones.

2. It can also flag messages from people. Co-authored-by: Claude Dupont <claude@example.com> matches, and so does PR text such as "generated by gofmt using the copilot instructions". Since this may become a required check, should the co-authored-by part match only on the email domain or known bot addresses, such as noreply@anthropic.com or Copilot@users.noreply.github.com, rather than on the display name?

What do you think of these?

[davecheney]

I think good enough is better than perfect here, it’ll
always be whack a mole, but hopefully this takes a bit of pressure off maintainers to double check co-authored commits, and give contributors faster feedback.

Let me take another swing at making this wider, not tighter, with the view that this will probably be a perpetual work in progress

[deadprogram]

Thanks for helping reduce the noise @davecheney