[sentry-junior]

The prepare-commit-msg hook removes every Co-authored-by line, then adds only the human actors of the current run. A run with no human actor (PR event follow-ups, automations, child agents) adds nobody. So when one of those runs amends or rebases, earlier credit is gone. That's how #2647 lost dingsdax's credit: a pull_request.comment.created follow-up rebased the branch and force-pushed, and none of the new commits had his trailer.

The hook now builds co-authors from the commits being replaced, then appends the current run's human actors. It finds those commits from Git state:

• --amend, -c/-C, reword: the source commit. --amend -m/-F give no commit arg, so the hook reads --amend from the parent git commit cmdline.
• rebase pick and cherry-pick: CHERRY_PICK_HEAD. A conflicted rebase step: REBASE_HEAD. An edit stop (rebase-merge/amend) that makes a new commit gets no inherited credit.
• fixup/squash: HEAD plus the folded commit. Rebased merges: the merge -C commit. merge --squash: the commits listed in SQUASH_MSG.

Model-written message text still can't add co-authors. Trailers are deduped by email, and the bot is excluded.

Other bugs found while reproducing:

• The author check failed on an amend or rebase --continue of a commit a person authored, because Git passes the original author to the hook. It now accepts the author of a replaced commit only. A new commit with a spoofed author still fails.
• A one-line unscoped subject like chore: base was read as a trailer block, so Co-Authored-By got stuck right under the subject. The subject paragraph is never trailers now, and a trailer key has to start with a capital letter (or be co-authored-by), so feat: x lines in squash messages stay body text.
• The comment block Git adds for an editor (conflicts, squash) broke trailer detection. Trailers now go before it.
• The hook is POSIX sh now (passes shellcheck, tested under dash). -ef is replaced with a pwd -P comparison.

Known limits:

• rebase --apply and git am don't run prepare-commit-msg.
• -C <any sha> reuses that commit's co-authors and author.
• The --amend -m detection depends on /proc, so it only works on Linux (the sandbox).
• core.hooksPath overrides or commit-tree skip the hook. This is a guardrail, not a security boundary.

Follow-up, not in this PR: runs with no human actor on a PR could credit the PR's stored requester, so brand-new fixup commits get credit too.

via @thomasjiangcy.

--

View Session [Sentry]

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
junior-docs	Ready	Preview	Nov 5, 2026 12:54am UTC

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit a8547fc. Configure here.}