CI request: forbid @mentions in commit messages/descriptions

[orlp]

I would much appreciate it if a CI step was added that checks for and forbids @mentions being included in commit messages/descriptions.

If such a commit is merged into the Rust repository, then you will receive an additional notification every single time this commit gets merged/replayed into any fork. It is incredibly frustrating, and can't be protected against (to my knowledge) by unfollowing the issue/PR as each merge consists of a completely new mention as far as Github is concerned, possibly from many different repositories. It is, essentially, an unintended spam amplification attack.

[bjorn3]

Bors already escapes @mentions in the PR description: rust-lang/homu#100

[bjorn3]

I think this should not be a CI step, rather something rustbot posts. Doing it as CI step would break things if an @mention accidentally ends up in another repo that is included as subtree due to said repo not having this CI step and then a subtree sync is attempted.

[thaliaarchi]

Incidentally, I happen to be working on improving homu's escaping, because it overapproximates what GitHub considers a username. For example, punctuation handling is bad: @username, is escaped as `@username,`, instead of `@username`,. Also, they shouldn't be escaped when already within backticks. This doesn't improve the issue raised here, but the logic could probably be reused.

Edit: I've submitted that here:

• Escape auto-linked GitHub usernames more precisely homu#230

[Urgau]

I have taken the liberty to implemented such warning in triagebot (aka rustbot) in rust-lang/triagebot#1917.