Decision needed: three commits on main carry vendor advertising trailers #31

New Issue

clawbot · 2026-08-09T03:35:36+02:00

clawbot commented

2026-08-09 03:35:36 +02:00

Assigning to @sneak because the only fixes require rewriting published history on a protected branch, which I will not do unilaterally.

What I found

Auditing all 177 commits on main for the no-vendor-attribution rule, three commits from 2025-06-20 carry advertising trailers in their commit messages:

f569bc5 fix: convert for loops to Go 1.22+ integer range syntax (intrange)
9231409 fix: remove unnecessary string conversions (unconvert)
0d140b4 fix: correct file permissions in integration test (gosec G306)

Each ends with a "Generated with" line linking to a vendor site plus a Co-Authored-By: trailer naming a vendor address. A fourth commit, c6935d8 "add rules for claude", matched my scan only on its subject line — it is a legitimate commit that adds the agent-instructions file, and its message is clean. No tracked file in the working tree contains such a trailer; CLAUDE.md is your own instructions file and is expected.

All later commits are clean, so this is a closed set of three, all roughly fourteen months old and deep in history.

Why this needs you

Policy says never force-push to main. Every way to remove these trailers rewrites the three commits and therefore every one of the ~170 descendants, changing all their hashes and requiring a force-push to a protected branch. That is your call, not mine.

Options

Leave them. Zero risk. The trailers stay in history forever, visible in git log. Every commit made since is already clean, and nothing in the working tree is contaminated.
Rewrite history with git filter-repo to strip the trailer lines, then force-push main. Removes them completely. Breaks every existing clone and fork, invalidates all commit hashes referenced from issues and PR discussions in this tracker (several are cited by hash in earlier PRs), and requires temporarily lifting branch protection.
Record it instead of rewriting. Leave history intact and add a short note to REPO_POLICIES.md or the README stating the trailers in those three commits are historical artifacts and not endorsed attribution.

My recommendation

Option 1, and close this issue. The cost of rewriting is real and immediate — broken clones, dead hash references in this tracker, protection toggled off on a repo whose whole point is handling secrets — and the benefit is cosmetic tidiness in year-old commit messages that no consumer of this tool will read. Option 3 is a reasonable consolation if you want the record to state your position explicitly, and it costs one paragraph in a file that already exists.

If you pick 2, say so and I will script it and hand you the exact commands rather than running them myself.

Definition of done

Whichever option you choose is applied, or this issue is closed as intentionally-declined. No code change is implied by options 1 or 3 beyond, at most, one documentation paragraph.

Not blocking any other 1.0 work — I am proceeding with the security blockers.

Assigning to @sneak because the only fixes require rewriting published history on a protected branch, which I will not do unilaterally. ## What I found Auditing all 177 commits on `main` for the no-vendor-attribution rule, three commits from 2025-06-20 carry advertising trailers in their commit messages: - `f569bc5` fix: convert for loops to Go 1.22+ integer range syntax (intrange) - `9231409` fix: remove unnecessary string conversions (unconvert) - `0d140b4` fix: correct file permissions in integration test (gosec G306) Each ends with a "Generated with" line linking to a vendor site plus a `Co-Authored-By:` trailer naming a vendor address. A fourth commit, `c6935d8` "add rules for claude", matched my scan only on its subject line — it is a legitimate commit that adds the agent-instructions file, and its message is clean. No tracked file in the working tree contains such a trailer; `CLAUDE.md` is your own instructions file and is expected. All later commits are clean, so this is a closed set of three, all roughly fourteen months old and deep in history. ## Why this needs you Policy says never force-push to `main`. Every way to remove these trailers rewrites the three commits and therefore every one of the ~170 descendants, changing all their hashes and requiring a force-push to a protected branch. That is your call, not mine. ## Options 1. **Leave them.** Zero risk. The trailers stay in history forever, visible in `git log`. Every commit made since is already clean, and nothing in the working tree is contaminated. 2. **Rewrite history** with `git filter-repo` to strip the trailer lines, then force-push `main`. Removes them completely. Breaks every existing clone and fork, invalidates all commit hashes referenced from issues and PR discussions in this tracker (several are cited by hash in earlier PRs), and requires temporarily lifting branch protection. 3. **Record it instead of rewriting.** Leave history intact and add a short note to `REPO_POLICIES.md` or the README stating the trailers in those three commits are historical artifacts and not endorsed attribution. ## My recommendation Option 1, and close this issue. The cost of rewriting is real and immediate — broken clones, dead hash references in this tracker, protection toggled off on a repo whose whole point is handling secrets — and the benefit is cosmetic tidiness in year-old commit messages that no consumer of this tool will read. Option 3 is a reasonable consolation if you want the record to state your position explicitly, and it costs one paragraph in a file that already exists. If you pick 2, say so and I will script it and hand you the exact commands rather than running them myself. ## Definition of done Whichever option you choose is applied, or this issue is closed as intentionally-declined. No code change is implied by options 1 or 3 beyond, at most, one documentation paragraph. Not blocking any other 1.0 work — I am proceeding with the security blockers.

clawbot added this to the 1.0.0 milestone 2026-08-09 03:35:36 +02:00

sneak was assigned by clawbot

2026-08-09 03:35:36 +02:00

sneak closed this issue

2026-08-09 16:05:48 +02:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: sneak/secret#31