feat: pull PR commits for Co-Authored-By attribution on PR reviews

PR webhooks only carry title/body; fetch /pulls/{i}/commits so the
trailer ledger and per-agent digests attribute PR reviews correctly.

Co-Authored-By: Claude Fable 5 <[email protected]>

src/lib/gitea.js

@@ -65,6 +65,10 @@ export class GiteaClient {
     });
   }
 
+  getPrCommits(owner, repo, index) {
+    return this.req('GET', `/api/v1/repos/${owner}/${repo}/pulls/${index}/commits?limit=50`);
+  }
+
   getCommit(owner, repo, sha) {
     return this.req('GET', `/api/v1/repos/${owner}/${repo}/git/commits/${sha}?stat=false&verification=false&files=false`);
   }

src/lib/review.js

@@ -19,6 +19,18 @@ export async function runReview({ cfg, gitea, db, job, withGlobal, log }) {
   const dashboardUrl = `${cfg.publicBaseUrl}/review/${owner}/${repo}`;
   const t0 = Date.now();
 
+  // For PR events the webhook only carries title/body; pull the PR's commits
+  // so Co-Authored-By trailer attribution sees real commit messages.
+  if (job.prIndex) {
+    const commits = await safe(log, 'pr-commits', () => gitea.getPrCommits(owner, repo, job.prIndex));
+    if (Array.isArray(commits)) {
+      job.commitMessages = job.commitMessages.concat(
+        commits.map(c => c?.commit?.message || '').filter(Boolean));
+      const names = commits.map(c => c?.commit?.author?.name || c?.author?.login).filter(Boolean);
+      job.authors = [...new Set(job.authors.concat(names))];
+    }
+  }
+
   // 0. pending status (best-effort)
   await safe(log, 'pending-status', () =>
     gitea.postStatus(owner, repo, sha, {