From 7da64b7e79a43865fd8badb7799b160daed3e36b Mon Sep 17 00:00:00 2001 From: Olaoluwa Osuntokun Date: Fri, 7 Aug 2026 12:48:17 -0700 Subject: [PATCH 1/2] ci: attribute nightly sweep commits to the deploy bot The nightly's commits were showing up on GitHub as "lumos-doc-bot and claude committed", where we want the deploy bot alone. Two independent causes, one per half of that string. The author identity was never linked to any account. GitHub attributes a commit by matching the author email against an account's verified addresses, and we were committing as bot@lightning.engineering, which matches nothing -- so the sweeps rendered as an unlinked plain-text name with a default avatar rather than as lightninglabs-deploy. Switch to the account's canonical `+@users.noreply.github.com` address, which is the form GitHub resolves back to the account. The trailing "and claude" came from a Co-Authored-By trailer appended to the commit message. The prompt's message template never included one, so add an explicit constraint forbidding it, along with any other generated by attribution footer, on both the commit message and the PR body. --- .github/workflows/doc-gardening-nightly.yml | 23 +++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/.github/workflows/doc-gardening-nightly.yml b/.github/workflows/doc-gardening-nightly.yml index f41619bbb..72cfd0053 100644 --- a/.github/workflows/doc-gardening-nightly.yml +++ b/.github/workflows/doc-gardening-nightly.yml @@ -105,10 +105,18 @@ jobs: # Bot identity for commits. Set via env vars instead of # `git config` so Claude doesn't need Bash(git config:*) in its # allowlist. - GIT_AUTHOR_NAME: wavelength-doc-bot - GIT_AUTHOR_EMAIL: bot@lightning.engineering - GIT_COMMITTER_NAME: wavelength-doc-bot - GIT_COMMITTER_EMAIL: bot@lightning.engineering + # Use the deploy bot's GitHub noreply address, not a vanity + # domain. GitHub attributes a commit to an account by matching + # the author email against that account's verified addresses, so + # `bot@lightning.engineering` matched nothing and every sweep + # commit rendered as an unlinked plain-text name with a default + # avatar. The `+@users.noreply.github.com` form is the + # account's canonical address and is what links the commit to + # lightninglabs-deploy. + GIT_AUTHOR_NAME: lightninglabs-deploy + GIT_AUTHOR_EMAIL: 58193817+lightninglabs-deploy@users.noreply.github.com + GIT_COMMITTER_NAME: lightninglabs-deploy + GIT_COMMITTER_EMAIL: 58193817+lightninglabs-deploy@users.noreply.github.com # Surface GitHub Actions context into Claude's env so the prompt # can interpolate via shell $VAR expansion instead of templating. REPO_NAME: ${{ github.repository }} @@ -268,6 +276,13 @@ jobs: - Never push to `main` directly. - Never modify files outside this repo. - Never add reviewers or assignees to the PR. + - The commit message must be exactly the template above and + nothing else. Do not append a `Co-Authored-By:` trailer, a + `Generated with Claude Code` line, or any other attribution + footer, to either the commit message or the PR body. A + `Co-Authored-By` trailer makes GitHub render the sweep as + "lightninglabs-deploy and claude committed"; these commits + should be attributed to the deploy bot alone. - This sweep is docs-only. Never run `go build`, `go test`, or anything that compiles the tree — those drop stray binaries (`accounting`, etc.) into package dirs that then get swept From 672092dec102e87271de46495c6862fc4dce86a7 Mon Sep 17 00:00:00 2001 From: Olaoluwa Osuntokun Date: Fri, 7 Aug 2026 12:49:03 -0700 Subject: [PATCH 2/2] ci: disable the Claude co-author trailer via action settings The prompt constraint added in the previous commit cannot actually stop the Co-Authored-By trailer. The CLI appends it as a post-processing step after the model writes the commit message file, so the model's text is overridden no matter what we tell it to write. Use the supported lever instead: the action's `settings` input, set to {"includeCoAuthoredBy": false}, which suppresses the trailer on both commits and PRs. Note this is an action input taking inline JSON or a file path, not a CLI flag -- there is no --settings to pass through claude_args, so routing it that way would have failed the step. The prompt constraint stays as documentation of the intent, but this input is what enforces it. --- .github/workflows/doc-gardening-nightly.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/.github/workflows/doc-gardening-nightly.yml b/.github/workflows/doc-gardening-nightly.yml index 72cfd0053..c8657f442 100644 --- a/.github/workflows/doc-gardening-nightly.yml +++ b/.github/workflows/doc-gardening-nightly.yml @@ -150,6 +150,15 @@ jobs: # by keeping BOT_GITHUB_TOKEN a fine-grained PAT scoped to only # these repos; log readers are first-party. Accepted on that # basis. + # Suppress the `Co-Authored-By: Claude` trailer so sweep commits + # are attributed to the deploy bot alone. This must be done here + # rather than by telling the model not to write the trailer: the + # CLI appends it as a post-processing step AFTER the model writes + # the message file, so a prompt constraint cannot prevent it. + # Note this is the action's `settings` input, which takes inline + # JSON or a file path — there is no `--settings` CLI flag to pass + # through claude_args. + settings: '{"includeCoAuthoredBy": false}' show_full_output: "true" prompt: | You are running in a nightly GitHub Actions cron job. Your job