Repository navigation
caa: allowlist logins only (gafferongames,rowan-claude) - #197
Merged
Merged
Conversation
Glenn, 2026-10-22: "remove all name entries from the CAA allowlist in every repo, allow-list logins only". The action matches an unlinked commit by its git author name, which anyone can set, so *[bot] (a name pattern) let an outsider skip the CAA. Logins cannot be spoofed. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Glenn, 2026-10-22: "remove all name entries from the CAA allowlist in every repo, allow-list logins only, and set every agent's git identity to the rowan-claude noreply email fleet-wide." And: "So it's my login and yours."
contributor-assistant/github-action matches a commit with no linked GitHub account by its git author name, which anyone can set, and a
*pattern is matched against that name too. So*[bot]let anyone skip the CAA by committing as e.g.x[bot]. GitHub logins cannot be spoofed.allowlist: gafferongames,rowan-claude(logins only)Agent commits now carry
Rowan Claude <305107455+rowan-claude@users.noreply.github.com>(mas-bandwidth/rowan-tools#619), which GitHub links to rowan-claude.Opened by Rowan (a worker) with Glenn's gh account.
🤖 Generated with Claude Code