ci(partof-guard): the closing-keyword gate reads every commit message on the PR (#16371)

The gate judged one of the two surfaces GitHub's reference parser acts on.
It read the PR body; it never read the commit messages, and this repo
squash-merges, so the message that lands on the default branch is assembled
at merge time by concatenating them. That text is written by nobody and
reviewed by nobody: it carries every trailer its inputs carried, and it can
contradict itself where none of its parts did.

The specimen is the squash of PR 16247, commit fc3fb7c, an ancestor of
the default branch: three bullets, a closing trailer for a card inside the
first bullet's body, and a third bullet retracting a claim the first still
makes. No body-side rule could have seen it -- the contradictory text
existed in no body -- and the sweep's H23, which patrols this surface after
merge, binds narrower and is silent on it: H23 reports only the Part-of plus
closing-keyword contradiction, and this specimen declares no Part-of at all.

So the gate now enforces a second, strictly wider rule: no commit on the PR
may carry a card-relation trailer at all. Width is what makes it
enforceable -- "trailers that would contradict each other once concatenated"
is a property of an assembly that does not exist until the merge button,
while "no trailer in any commit" is a property of one commit. An assembly
cannot manufacture what none of its inputs contain.

The relation extractors are the sweep's, imported at `markdown: false` and
not re-spelled: a fourth spelling of the closing-keyword grammar would be a
fourth thing for the parity gate to hold in step, and the commit-message
reading is a measured contract of that sweep rather than this gate's call.

The workflow gathers the list and hands it over as a file path, so the
judging path stays HTTP-free by construction. The endpoint is read rather
than `git log base..head` walked: it returns exactly the set GitHub will
squash, while the walk needs a merge base this depth-1 checkout does not
have and would report another author's landed trailers as this PR's.

An absent, malformed or empty commit list exits 2 and says which rule judged
nothing. A wiring that forgot the commits has not seen a clean commit
history, and the two must never print the same line.

Self-test batteries 9 -> 15, cases 28 -> 66, with the real squash message as
the regression fixture.


Claude-Session: https://claude.ai/code/session_01Vbw3RPgdtqesx4azk9SbW8

Co-authored-by: Claude <noreply@anthropic.com>

Author: baozhoutao

.github/workflows/partof-closing-keyword-guard.yml

@@ -33,8 +33,14 @@ on:
   pull_request:
     types: [opened, edited, reopened, synchronize]
 
+# `contents: read` checks the repo out to get at the script. `pull-requests:
+# read` is what the commit-list gather below needs, and naming a `permissions:`
+# block at all sets every scope NOT listed to `none`, so both must be spelled.
+# Read-only is the whole grant: this gate reports, and never closes a PR,
+# comments, or edits a body.
 permissions:
   contents: read
+  pull-requests: read
 
 concurrency:
   group: partof-closing-keyword-${{ github.event.pull_request.number }}
@@ -87,8 +93,47 @@ jobs:
       # No install step: the script imports one sibling module and reads no
       # workspace package, so `node` on the pinned runtime is the whole
       # toolchain it needs.
-      - name: A Part-of PR body may not carry a closing keyword for the same card
+      # RULE 2's input. The script judges it but never fetches it: the judging
+      # path stays HTTP-free, and the gather is a step of its own so that a
+      # network failure reads as a failed gather rather than as a verdict about
+      # somebody's PR.
+      #
+      # The endpoint is chosen over `git log base..head` deliberately. It
+      # returns exactly the set GitHub will squash. The git walk needs the merge
+      # base present to exclude what is already on the default branch, and the
+      # checkout above is depth 1 — so on a branch that has merged `main` back
+      # in, the walk cannot exclude those commits and would report another
+      # author's landed trailers as this PR's. Deepening until the merge base
+      # appears is unbounded, and `fetch-depth: 0` clones the whole repository
+      # to read a handful of messages.
+      #
+      # `--paginate` is load-bearing: without it a PR over one page silently
+      # loses its later commits, and a rule that read half the commits would
+      # report the unread half as clean. `--jq` emits one JSON object per line,
+      # and JSON escapes the newlines inside a commit message, so one row really
+      # is one line. The messages go to a FILE rather than into the environment:
+      # they are multi-line attacker-controlled text, and a path is inert where
+      # a body of prose is not.
+      #
+      # No pipeline here, on purpose. A `run:` block executes as `bash -e`
+      # WITHOUT pipefail, so `gh ... | jq ...` would take jq's exit code and a
+      # failed gather would reach the script as an empty file. It is a single
+      # redirect, so a failing `gh` fails the step; and if it ever did produce an
+      # empty file, the script reads zero rows as a failed gather, not as a PR
+      # with no commits.
+      - name: Gather the PR's commit messages
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          REPO: ${{ github.repository }}
+        run: >
+          gh api --paginate "/repos/$REPO/pulls/$PR_NUMBER/commits"
+          --jq '.[] | {sha: .sha, message: .commit.message}'
+          > "$RUNNER_TEMP/pr-commits.jsonl"
+
+      - name: A PR body may not close the card it is only part of, and no commit may carry a card trailer
         env:
           PR_BODY: ${{ github.event.pull_request.body }}
           PR_NUMBER: ${{ github.event.pull_request.number }}
+          PR_COMMITS_FILE: ${{ runner.temp }}/pr-commits.jsonl
         run: node scripts/check-partof-closing-keyword.mjs