-
-
Notifications
You must be signed in to change notification settings - Fork 15
67 lines (60 loc) · 3.02 KB
/
Copy pathcommit-check.yml
File metadata and controls
67 lines (60 loc) · 3.02 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
name: Commit Check
permissions:
contents: read
on:
# Pull requests only, deliberately.
#
# A push to main carries the squashed commit, whose subject is the pull
# request title with " (#N)" appended by GitHub. Checking there re-runs work
# that already passed, against a subject the author never wrote and cannot
# shorten — which is how #530 passed review at 75 characters and then failed
# on main at 82, against a limit of 80.
#
# No `paths:` filter either. A subject, a branch name or an author address is
# wrong regardless of which files the change touches, and the filter on
# main.yml is why nothing ran on #530 at all: it changed only assets/.
#
# `edited` matters: a squash merge turns the title into the commit subject,
# so retitling a pull request changes what will be committed.
pull_request:
types: [opened, synchronize, reopened, edited]
jobs:
commit-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
with:
fetch-depth: 0 # full history, so branch and rebase checks can resolve
# Nothing after checkout needs authenticated git.
persist-credentials: false
- uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: '3.x'
# From source, not from PyPI, and not through commit-check-action.
#
# The action installs a released commit-check, so running it here would
# check this pull request with the version before it — which is how #540
# had its own title rejected by the bug it was fixing. A self-test that
# cannot see the change under test is not a self-test.
- name: Install commit-check from this checkout
run: python -m pip install .
- name: Check the title, the branch and the author
env:
# Via the environment, never interpolated into the script: a pull
# request title is attacker-controlled text.
PR_TITLE: ${{ github.event.pull_request.title }}
run: |
# The title, because a squash merge commits it as the subject. The
# branch's own commit messages are not checked: this repository
# squashes, so they never reach main. A local hook is where that
# feedback belongs — it arrives while the message is being written,
# not a CI round trip later.
#
# Not a bare `commit-check --message` either. That reads HEAD, which
# on a pull_request checkout is the synthetic merge commit, which the
# engine skips — so it would report a pass having read nothing.
printf '%s\n' "$PR_TITLE" | commit-check --message --no-banner
# stdin closed: left open, commit-check waits to read a message even
# for checks that do not take one, and the step hangs rather than
# fails. --branch resolves GITHUB_HEAD_REF on a detached checkout.
commit-check --branch --author-name --author-email --no-banner < /dev/null