commit-lint.yml

name: commit-lint

# Lint every non-merge commit of a pull request against the repository's commit
# convention (CONTRIBUTING.md), using the same script as the local commit-msg
# hook. A bypassed local hook (`git commit --no-verify`) is caught here.

on:
  pull_request:

permissions:
  contents: read

jobs:
  commit-lint:
    name: Conventional commits
    runs-on: ubuntu-latest
    # Message linting is seconds; cap a stuck runner.
    timeout-minutes: 10
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
        with:
          # Need the PR's commits, so fetch full history rather than a shallow tip.
          fetch-depth: 0

      - name: Lint the pull request commits
        env:
          BASE_SHA: ${{ github.event.pull_request.base.sha }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        shell: bash
        run: |
          set -euo pipefail
          echo "Linting non-merge commits in ${BASE_SHA}..${HEAD_SHA}"
          # --no-merges: merge commits are generated by GitHub and are exempt.
          commits="$(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}")"
          if [ -z "${commits}" ]; then
            echo "No non-merge commits to lint."
            exit 0
          fi
          status=0
          for sha in ${commits}; do
            echo "── $(git log -1 --format='%h %s' "${sha}")"
            # Dependabot writes its own mechanical `bump …` headers (their length is
            # driven by the package name, so a long name alone can overrun the 72-char
            # limit) and cannot amend them. They are generated by a trusted bot, not a
            # contributor, so exempt them here rather than let routine dependency PRs
            # fail the lint. Identify the bot by its commit author, which a human
            # commit never carries. If Claude's dependabot-autofix triage later rewrites
            # such a message, the author changes and the rewrite is linted normally.
            author_email="$(git log -1 --format='%ae' "${sha}")"
            case "$author_email" in
              *dependabot*)
                echo "   skipped (Dependabot-authored)"
                continue
                ;;
            esac
            if git log -1 --format=%B "${sha}" | tools/commit-lint/lint-commit-message.sh --ci -; then
              echo "   ok"
            else
              status=1
            fi
          done
          if [ "${status}" -ne 0 ]; then
            echo
            echo "One or more commit messages do not follow CONTRIBUTING.md."
            echo "Fix them with an interactive rebase (git rebase -i) before merge."
          fi
          exit "${status}"