fix(ci): exempt bot commits from the attribution check

[CryptoJones]

Every Dependabot PR has been red since the attribution check landed, and no rebase can fix it: Dependabot cannot add a trailer to its own commit message, so check-attribution.sh --range fails it by construction. #265 has sat open since 2026-08-16 on exactly this, with 15 other checks green.

The change

The script already exempts merges and reverts as "generated by git/GitHub, not authored by anyone." A bot commit is the same category. It is now exempted the same way — matched on a [bot] author, only in the --range path where an author exists to inspect.

What is deliberately unchanged

• The declaration rule still binds every human and agent commit. A message with no trailer is still rejected.
• The --message-file path (the commit-msg hook) exempts nothing. It has no author to inspect, so a local commit cannot dodge the rule by claiming to be a bot.
• Matching is on the author line, not the message, so a human cannot opt out by typing [bot] into a commit body.

Verified

Case	Result
--range over #265's Dependabot commit	passes (was the sole failure)
A message with no trailer, via --message-file	still rejected
origin/main~3..origin/main	still passes
sh -n scripts/check-attribution.sh	clean

Worth your judgment

This adds a bypass to an enforcement gate in a project whose whole thesis is that enforcement gates should not have bypasses. The argument for it is that the alternative is not stricter — a check that is red on every dependency PR forever is one the team learns to ignore, which is how the gate stops working in practice. If you would rather keep the gate absolute and merge Dependabot PRs with an admin override, revert this and I will close #265 instead.

Proudly Made in Nebraska. Go Big Red! 🌽 https://xkcd.com/2347/

🤖 Generated with Claude Code

https://claude.ai/code/session_01DRXCexxuJWz949htNeqFZj

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Advanced

Run ID: d538da42-eca6-4a71-830c-6b64e336b20e

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}