commitlint.yml

name: Commitlint

on:
  pull_request:
    types: [opened, synchronize, reopened, edited]

permissions:
  contents: read

jobs:
  commitlint:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 2

      - name: Use Node 22
        uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
        with:
          node-version: 22

      # Install only commitlint, at the versions pinned in the root package.json,
      # into a scratch directory instead of installing the whole monorepo.
      # The repo config is copied next to it so `extends` resolves there.
      - name: Install commitlint
        run: |
          CL_DIR="$RUNNER_TEMP/commitlint"
          mkdir -p "$CL_DIR"
          CLI_VERSION=$(node -p "require('./package.json').devDependencies['@commitlint/cli']")
          CONFIG_VERSION=$(node -p "require('./package.json').devDependencies['@commitlint/config-conventional']")
          for v in "$CLI_VERSION" "$CONFIG_VERSION"; do
            if ! printf '%s' "$v" | grep -Eq '^[~^]?[0-9]+\.[0-9]+\.[0-9]+'; then
              echo "::error::Root package.json must pin @commitlint/cli and @commitlint/config-conventional to a semver version (got '$v')"
              exit 1
            fi
          done
          cp commitlint.config.ts "$CL_DIR/"
          cd "$CL_DIR"
          npm init -y >/dev/null
          npm install --no-audit --no-fund --ignore-scripts \
            "@commitlint/cli@$CLI_VERSION" "@commitlint/config-conventional@$CONFIG_VERSION"
          echo "CL_DIR=$CL_DIR" >> "$GITHUB_ENV"

      # The Dependabot exemption must stay narrow: its own subjects pass, any
      # other sentence-case subject still fails (DOS/Rate#725).
      - name: Check the Dependabot exemption
        run: |
          cd "$CL_DIR"
          for ok in \
            'build(deps-dev): Bump sass from 1.105.1 to 1.105.2' \
            'build(deps): Bump actions/upload-artifact from 7.0.1 to 7.0.2' \
            'chore(deps): Bump the npm_and_yarn group across 1 directory with 2 updates'; do
            printf '%s\n\nBumps [x](https://github.com/x/x) from 1 to 2. A long Dependabot body line that is well over one hundred characters long.\n' "$ok" \
              | npx --no-install commitlint >/dev/null || { echo "::error::should pass: $ok"; exit 1; }
          done
          for bad in \
            'fix(web): Add a sentence-case subject' \
            'build(deps): Bump sass' \
            'build: Bump sass from 1 to 2'; do
            if printf '%s\n' "$bad" | npx --no-install commitlint >/dev/null 2>&1; then
              echo "::error::should fail: $bad"; exit 1
            fi
          done

      # Lint the PR head commit, not the synthetic merge commit that
      # actions/checkout uses for pull_request (commitlint ignores "Merge ...").
      # fetch-depth: 2 includes the head commit as the merge commit's parent.
      - name: Lint PR title and head commit message
        env:
          PR_TITLE: ${{ github.event.pull_request.title }}
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          HEAD_MESSAGE=$(git log -1 --pretty=%B "$HEAD_SHA")
          cd "$CL_DIR"
          printf '%s\n' "$PR_TITLE" | npx --no-install commitlint
          printf '%s\n' "$HEAD_MESSAGE" | npx --no-install commitlint