Skip to content

Detect AI contribution records in git-notes#20

Merged
andrew merged 1 commit into
mainfrom
detect-git-notes-ai-records
May 26, 2026
Merged

Detect AI contribution records in git-notes#20
andrew merged 1 commit into
mainfrom
detect-git-notes-ai-records

Conversation

@andrew
Copy link
Copy Markdown
Contributor

@andrew andrew commented Mar 18, 2026

Adds a gitnotes detector that reads AI authorship logs stored under refs/notes/ai per the git-ai standard v3.0.0.

The detector parses the attestation and JSON metadata sections, extracting tool names and models from prompt records. Findings are reported at high confidence since git-ai notes are an explicit, structured declaration of AI involvement.

Changes:

  • New detection/gitnotes package with detector and tests
  • gitops.Commit and detection.Input gain a Notes field
  • gitops.readNote() reads note blobs from refs/notes/ai, handling both flat and split hash path formats
  • Integration test in scan_test.go creates a real repo with git notes via the git CLI

fixes #9

Add a gitnotes detector that reads authorship logs from refs/notes/ai,
parsing the git-ai standard v3.0.0 format to extract tool and model
information from the metadata section's prompt records.

Signed-off-by: Andrew Nesbitt <andrewnez@gmail.com>
@andrew andrew force-pushed the detect-git-notes-ai-records branch from b7678e7 to 3ea5d86 Compare March 18, 2026 12:22
@andrew andrew requested a review from MoralCode March 18, 2026 12:27
@MoralCode
Copy link
Copy Markdown
Contributor

Does this fix #9?

Comment thread gitops/gitops.go
if err != nil {
continue
}

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this function feels like it belongs in the gitnotes module. the gitops name makes me think of generic git operations, rather than something specific to gitnotes

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hi Adrian, reading a git note is indeed a generic git operation (see https://git-scm.com/docs/git-notes for reference).

In this PR's context, gitnotes module is a detector module specific to disclosure detection rather than git operations, so it looks to me that current function location may be correct.

@andrew andrew merged commit 83d3812 into main May 26, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Development

Successfully merging this pull request may close these issues.

detect ai use from git ai refs

3 participants