fix: Signed-off-by trailer not being added to verbose commits

[aadam-ali]

Description

When using an editor to write commit messages with the commit.verbose config option set to true, the Signed-off-by trailer is not added to commits.

With the config option set, the following warning is shown:

# ------------------------ >8 ------------------------
# Do not modify or remove the line above.
# Everything below it will be ignored.

The commit-msg hook appends the trailer to the end of the commit message file, meaning it's appended after this line therefore it's not actually added to the commit message.

This change filters out the contents of a commit message from the cut-off line ensuring that the Signed-off-by trailer is actually added to these commits.

Note, we are not using the builtin trailer functionality as this requires the trailers to be passed alongside the commit command. This hook running against commit-msg events allows additional logic to validate that the security scan pre-commit hook exists, conditionally adding the Signed-off-by trailer if so.

Contributors

@aadam-ali

Type of change

• Refactoring (made code better without changing its behaviour)
• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)

How this has been tested

Unit tests have been added, whilst ensuring the existing tests continue to pass.

This repository also runs the validate hook using the source code from the current branch. The trailer was successfully added when this ran.

Checklist

• I have performed a self-review of my code
• I have commented my code in hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings

Reviewer Checklist

• I have reviewed the PR and ensured no secret values are present

[github-actions]

Dependency Review

✅ No vulnerabilities or OpenSSF Scorecard issues found.

Scanned Files

None

[sumau]

Thanks @aadam-ali ! Using # ------------------------ >8 ------------------------ feels very brittle, are you sure that's the best way to determine the end of the commit message? It could be just wanted to make sure :-)

[aadam-ali]

Thanks @aadam-ali ! Using # ------------------------ >8 ------------------------ feels very brittle, are you sure that's the best way to determine the end of the commit message? It could be just wanted to make sure :-)

I initially had the same concern, but having read the Git docs, this is documented https://git-scm.com/docs/git-commit#Documentation/git-commit.txt-scissors.