commit-lint.yml

# Copyright 2026 The ARCORIS Authors
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

# Commitlint workflow for repository-local Conventional Commit enforcement.
#
# Keep this workflow intentionally narrow:
# - validate commit messages and PR titles, not PR review state;
# - use the repository's `commitlint.config.cjs`;
# - keep event-to-commit-range logic in a repository script, not inline bash.
"name": "Commit Lint"

"on":
  # Lint commits introduced through the ordinary PR review flow.
  pull_request:
    branches:
      - "main"
    types:
      - "opened"
      - "edited"
      - "synchronize"
      - "reopened"
      - "ready_for_review"

  workflow_dispatch:

permissions:
  # Read-only access is enough for commit history inspection and PR metadata.
  contents: "read"
  pull-requests: "read"

concurrency:
  # Keep only the newest commit-lint run for the same ref.
  group: "commit-lint-${{ github.workflow }}-${{ github.ref }}"
  cancel-in-progress: true

jobs:
  commitlint:
    # Keep the job name stable so branch protection can require this exact
    # check for pull requests into `main`.
    name: "commitlint"
    runs-on: "ubuntu-latest"
    timeout-minutes: 10

    steps:
      - name: "Checkout repository"
        # actions/checkout v6
        uses: "actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd"
        with:
          # commit range validation requires real history.
          fetch-depth: 0
          persist-credentials: false

      - name: "Setup Node.js"
        # actions/setup-node v6
        uses: "actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e"
        with:
          # Match the release workflow's Node policy.
          #
          # This repository is not a Node application and intentionally keeps
          # its pinned commitlint toolchain isolated under `tools/commitlint`
          # instead of adding a root-level Node manifest.
          node-version: "24"
          package-manager-cache: false

      - name: "Setup Python"
        # actions/setup-python v6
        uses: "actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405"
        with:
          # The repository commitlint orchestration script uses only the Python
          # standard library, but pinning the runtime keeps workflow behavior
          # explicit instead of depending on the runner image implicitly.
          python-version: "3.12"

      - name: "Show tool versions"
        run: |
          node --version
          npm --version
          git --version
          python3 --version

      - name: "Install pinned commitlint toolchain"
        run: |
          npm ci --prefix tools/commitlint --ignore-scripts --no-audit --fund=false

      - name: "Verify commitlint configuration exists"
        run: test -f commitlint.config.cjs

      - name: "Show commitlint version"
        run: tools/commitlint/node_modules/.bin/commitlint --version

      - name: "Lint pull request title"
        if: ${{ github.event_name == 'pull_request' }}
        env:
          PR_TITLE: "${{ github.event.pull_request.title }}"
        run: |
          # Squash merges often use the PR title as the final commit header.
          # Keep the title under the same Conventional Commit policy as commits.
          printf '%s\n' "${PR_TITLE}" | tools/commitlint/node_modules/.bin/commitlint --config commitlint.config.cjs --verbose

      - name: "Run repository commitlint orchestration"
        env:
          EVENT_NAME: "${{ github.event_name }}"
          GITHUB_SHA_VALUE: "${{ github.sha }}"
          PUSH_BEFORE: "${{ github.event.before }}"
          PR_BASE_SHA: "${{ github.event.pull_request.base.sha }}"
          PR_HEAD_SHA: "${{ github.event.pull_request.head.sha }}"
          MG_BASE_SHA: "${{ github.event.merge_group.base_sha }}"
        run: |
          # Keep event routing and range selection in a repository script so the
          # same logic can be understood and reproduced outside GitHub Actions.
          python3 scripts/run_commitlint.py \
            --repo-root . \
            --config-path commitlint.config.cjs \
            --summary-path .commitlint-summary.md \
            --event-name "${EVENT_NAME}" \
            --github-sha "${GITHUB_SHA_VALUE}" \
            --push-before "${PUSH_BEFORE}" \
            --pr-base-sha "${PR_BASE_SHA}" \
            --pr-head-sha "${PR_HEAD_SHA}" \
            --merge-group-base-sha "${MG_BASE_SHA}"

      - name: "Publish commitlint summary"
        if: always()
        shell: "bash"
        run: |
          if [ -f .commitlint-summary.md ]; then
            cat .commitlint-summary.md >> "$GITHUB_STEP_SUMMARY"
          else
            echo "# Commit Lint Summary" >> "$GITHUB_STEP_SUMMARY"
            echo "" >> "$GITHUB_STEP_SUMMARY"
            echo "- Result: summary not generated" >> "$GITHUB_STEP_SUMMARY"
          fi