Add CI detection for grafted commits and large commits before lock file rebuild

[Copilot]

PR #10356 merged a grafted commit with 2,456 files (808K+ insertions) after reverting accidentally-included lock files, causing make recompile to fail. This was the 5th lock file recompilation failure on 2026-01-16.

Changes

Added two validation steps to the CI build job before "Rebuild lock files":

• Detect grafted commits (blocking): Checks git log -1 --oneline for (grafted) marker and fails with exit 1
• Check commit size (warning): Reports commits with >100 changed files to $GITHUB_STEP_SUMMARY

Both write diagnostic information to the workflow summary for visibility.

Implementation

- name: Detect grafted commits
  run: |
    if git log -1 --oneline | grep -q '(grafted)'; then
      echo "❌ ERROR: Grafted commit detected" >> $GITHUB_STEP_SUMMARY
      echo "This indicates shallow history or history manipulation" >> $GITHUB_STEP_SUMMARY
      exit 1
    fi
    echo "✅ No grafted commits detected" >> $GITHUB_STEP_SUMMARY

- name: Check commit size sanity
  run: |
    FILES_CHANGED=$(git show --stat | tail -1 | grep -oP '\d+(?= files? changed)' || echo "0")
    echo "📊 Files changed in last commit: $FILES_CHANGED" >> $GITHUB_STEP_SUMMARY
    
    if [ "$FILES_CHANGED" -gt 100 ]; then
      echo "⚠️ WARNING: Large commit detected ($FILES_CHANGED files)" >> $GITHUB_STEP_SUMMARY
      # Warning only, does not fail build
    fi

Rationale

Grafted commits indicate shallow history or history manipulation that breaks repository integrity. Detecting them before make recompile provides immediate feedback rather than cryptic compilation failures. The 100-file threshold catches accidental mass-commits (like the 110+ lock files in #10356) while allowing legitimate large changes to proceed with a warning.

Original prompt

---

This section details on the original issue you should resolve

<issue_title>[CI Failure Doctor] 🏥 CI Failure Investigation - Grafted Commit After Lock File Revert (Run #30058)</issue_title>
<issue_description># 🏥 CI Failure Investigation - Run githubnext/gh-aw#30058

Summary

Fifth lock file recompilation failure today, but with a different root cause: PR #10356 created a grafted commit (shallow history) containing 2,456 files after reverting accidentally-included lock files, causing make recompile to fail.

Failure Details

• Run: #21076916618
• Commit: 2a1b6bcc795680d118d0ec8b0ae56e3e22ef6eff (marked as grafted)
• PR: Fix blog author link styling and shorten AI author names #10356 - "Fix blog author link styling and shorten AI author names"
• Trigger: push to main branch
• Date: 2026-01-16 18:36:31Z
• Duration: 5m 29s

Root Cause Analysis

What Happened

1. PR Fix blog author link styling and shorten AI author names #10356 was created to fix blog author styling (should affect ~2 files)
2. Copilot agent accidentally included 110+ .lock.yml files in the commit
3. User requested: "@copilot revert changes to all .lock.yml files"
4. Copilot reverted all 110 lock files to previous state
5. Result: Grafted commit with 2,456 files and 808,566 insertions merged to main
6. CI Impact: make recompile step fails on the build job

Evidence

$ git log --oneline -1
2a1b6bc (grafted, HEAD -> main, origin/main) Fix blog author link styling and shorten AI author names (#10356)

$ git show --stat | tail -1
2456 files changed, 808566 insertions(+)

PR Comments Confirm the Issue

From PR #10356:

• mnkiefer (18:23:52Z): "@copilot revert changes to all .lock.yml files. They should not be part of this PR."
• Copilot (18:30:41Z): "Done. Reverted all 110 .lock.yml files to the state before my changes (commit c52f9b8)."

The revert operation created a grafted commit that included the entire repository history.

Failed Jobs and Errors

Job: build (60621009735)

• Failed Step: "Rebuild lock files" (step Weekly Research Report: AI Workflow Automation Landscape and Strategic Opportunities - August 2025 #9)
• Error: make recompile failed
• Root Cause: Repository contains grafted commit with 2,456 files, preventing normal recompilation
• Expected Files: ~2 files (blog styling changes)
• Actual Files: 2,456 files (entire repository structure)

Today's Lock File Failure Pattern (2026-01-16)

This is the FIFTH "Rebuild lock files" failure today:

Run	Time	Cause	Issue
21072294659	15:49Z	Runtime-import validation	#10330 (closed)
21073020832	16:14Z	Duplicate/recurrence	-
21075426131	17:47Z	Template injection validation	#10317
21076338584	18:14Z	Gitattributes + 125 lock files	#10347
21076916618	18:36Z	Grafted commit (THIS ONE)	New

Pattern shift: First 4 failures were validation bugs; this one is a repository integrity issue.

Investigation Findings

Why This Is Different

Previous failures (1-4): Code changes broke validation

• New validation code rejected valid workflows
• Fixed by reverting/correcting validation logic

THIS failure (#5): Repository history manipulation

• Grafted commit indicates shallow history or history rewrite
• Commit size (808K+ lines) doesn't match description ("blog styling")
• Not a code bug but a git operation issue

Red Flags

1. ✅ Git shows (grafted) marker - indicates history manipulation
2. ✅ Single commit adds 2,456 files including entire .github/workflows/ directory
3. ✅ PR description mentions "blog styling" but touches 2,456 files
4. ✅ Lock files were accidentally included, then reverted with a massive revert
5. ✅ The revert created a grafted commit instead of a clean revert

Recommended Actions

Immediate (Fix This Failure)

1. ⚠️ Revert commit 2a1b6bc - The grafted commit must be removed from main
2. 🔧 Create clean PR - Re-apply ONLY the blog styling changes (~2 files):
   • docs/astro.config.mjs (author name changes)
   • docs/src/styles/custom.css (styling overrides)
3. ✅ Run make agent-finish before merging the clean PR
4. 📝 Document incident - Add to runbook for future reference

Short-term (Prevent Recurrence)

1. Add CI protection against grafted commits:

- name: Detect grafted commits
  run: |
    if git log -1 --oneline | grep -q '(grafted)'; then
      echo "❌ ERROR: Grafted commit detected"
      echo "This indicates shallow history or history manipulation"
      exit 1
    fi

2. Add commit size validation:

- name: Check commit size sanity
  run: |
    FILES_CHANGED=$(git show --stat | tail -1 | grep -oP '\d+(?= files? changed)' || echo 0)
    if [ "$FILES_CHANGED" -gt 100 ]; then
      echo "⚠️ WARNING: Large commit ($FILES_CHANGED files)"
      echo "Verify this matches t...

</details>



<!-- START COPILOT CODING AGENT SUFFIX -->

- Fixes githubnext/gh-aw#10357

<!-- START COPILOT CODING AGENT TIPS -->
---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our [2 minute survey](https://gh.io/copilot-coding-agent-survey).