
  # commit-trailers (AG-03) — fail if any non-merge commit on this branch lacks
  # BOTH Signed-off-by and Co-Authored-By. The authoritative server-side half of
  # AG-03 (the .gitmessage template + prepare-commit-msg hook are the local half);
  # independent of any contributor's local config. The reference checker is
  # stdlib-only and fail-open on shallow-clone range quirks. git is apt-installed
  # because the python:slim image omits it; safe.directory clears git's
  # dubious-ownership check on the mounted workspace.
  - name: commit-trailers
    image: python:3.12-slim
    commands:
      - apt-get update -qq && apt-get install -y -qq --no-install-recommends git
      - git config --global --add safe.directory "$CI_WORKSPACE"
      - git fetch -q --depth=100 origin "${CI_COMMIT_TARGET_BRANCH:-main}" || true
      - python scripts/check_commit_trailers.py
