Skip to content

Commit e627aff

Browse files
committed
ci: add Change-Id trailer guard
Add Tools/check_change_id.sh and a commit-lint CI job that fails when any commit in the pushed/PR range carries a Gerrit Change-Id trailer. The Gerrit commit-msg hook injects these automatically; they are noise on the GitHub mirror. The script resolves the range from GitHub Actions env (base_ref for PRs, event.before for pushes) and degrades gracefully on shallow clones.
1 parent 953dd22 commit e627aff

2 files changed

Lines changed: 123 additions & 2 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 30 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,28 @@ on:
2626
- ".github/workflows/ci.yml"
2727

2828
jobs:
29+
# ============================================================
30+
# Commit Lint (guard against Gerrit Change-Id trailers)
31+
# ============================================================
32+
commit-lint:
33+
name: Commit Lint
34+
runs-on: ubuntu-latest
35+
36+
steps:
37+
- name: Checkout repository
38+
uses: actions/checkout@v4
39+
with:
40+
# Full history so the PR/push commit range can be resolved.
41+
fetch-depth: 0
42+
43+
- name: Check for Change-Id trailers
44+
env:
45+
GITHUB_BASE_REF: ${{ github.base_ref }}
46+
GITHUB_EVENT_BEFORE: ${{ github.event.before }}
47+
run: |
48+
chmod +x Tools/check_change_id.sh
49+
Tools/check_change_id.sh
50+
2951
# ============================================================
3052
# Lower Machine Tests (Embedded Firmware)
3153
# ============================================================
@@ -196,7 +218,7 @@ jobs:
196218
ci-summary:
197219
name: CI Summary
198220
runs-on: ubuntu-latest
199-
needs: [lower-machine, upper-machine]
221+
needs: [commit-lint, lower-machine, upper-machine]
200222
if: always()
201223

202224
steps:
@@ -207,6 +229,12 @@ jobs:
207229
echo "========================================="
208230
echo ""
209231
232+
if [ "${{ needs.commit-lint.result }}" == "success" ]; then
233+
echo "✅ Commit Lint: PASSED"
234+
else
235+
echo "❌ Commit Lint: FAILED"
236+
fi
237+
210238
if [ "${{ needs.lower-machine.result }}" == "success" ]; then
211239
echo "✅ Lower Machine Tests: PASSED"
212240
else
@@ -221,7 +249,7 @@ jobs:
221249
222250
echo ""
223251
224-
if [ "${{ needs.lower-machine.result }}" == "success" ] && [ "${{ needs.upper-machine.result }}" == "success" ]; then
252+
if [ "${{ needs.commit-lint.result }}" == "success" ] && [ "${{ needs.lower-machine.result }}" == "success" ] && [ "${{ needs.upper-machine.result }}" == "success" ]; then
225253
echo "🎉 All CI checks passed!"
226254
exit 0
227255
else

‎Tools/check_change_id.sh‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
#!/usr/bin/env bash
2+
#
3+
# check_change_id.sh - Fail if any commit message contains a Gerrit "Change-Id:"
4+
# trailer.
5+
#
6+
# The repo ships a Gerrit-style commit-msg hook (repo/hooks/commit-msg) that
7+
# auto-inserts Change-Id lines. Those are meaningful only when pushing to the
8+
# internal Gerrit; on the public GitHub mirror they are noise. This guard
9+
# catches such lines before they land on a protected branch.
10+
#
11+
# Usage:
12+
# Tools/check_change_id.sh [<range>]
13+
#
14+
# <range> Git revision range to inspect (e.g. origin/main..HEAD).
15+
# If omitted, the range is derived from environment variables set by
16+
# CI (GitHub Actions), falling back to just the tip commit (HEAD).
17+
#
18+
# Exit codes:
19+
# 0 no Change-Id found
20+
# 1 one or more commits contain a Change-Id trailer
21+
22+
set -euo pipefail
23+
24+
PATTERN='^Change-Id:'
25+
26+
resolve_range() {
27+
# 1) explicit arg wins
28+
if [ "$#" -ge 1 ] && [ -n "${1:-}" ]; then
29+
echo "$1"
30+
return
31+
fi
32+
33+
# 2) GitHub Actions pull_request: compare base..head
34+
if [ -n "${GITHUB_BASE_REF:-}" ]; then
35+
# base ref is the target branch of the PR
36+
if git rev-parse --verify --quiet "origin/${GITHUB_BASE_REF}" >/dev/null; then
37+
echo "origin/${GITHUB_BASE_REF}..HEAD"
38+
return
39+
fi
40+
fi
41+
42+
# 3) GitHub Actions push: event range before..after
43+
if [ -n "${GITHUB_EVENT_BEFORE:-}" ] \
44+
&& [ "${GITHUB_EVENT_BEFORE}" != "0000000000000000000000000000000000000000" ] \
45+
&& git rev-parse --verify --quiet "${GITHUB_EVENT_BEFORE}" >/dev/null; then
46+
echo "${GITHUB_EVENT_BEFORE}..HEAD"
47+
return
48+
fi
49+
50+
# 4) fallback: inspect only the tip commit
51+
echo "HEAD~1..HEAD"
52+
}
53+
54+
RANGE="$(resolve_range "$@")"
55+
56+
# Guard: if the range endpoints are missing (shallow clone), degrade to HEAD.
57+
if ! git rev-list "$RANGE" >/dev/null 2>&1; then
58+
echo "⚠️ Range '$RANGE' not resolvable (shallow clone?); checking HEAD only."
59+
RANGE="HEAD~1..HEAD"
60+
if ! git rev-list "$RANGE" >/dev/null 2>&1; then
61+
RANGE="HEAD"
62+
fi
63+
fi
64+
65+
echo "🔍 Checking commit messages for Change-Id in range: $RANGE"
66+
67+
offenders=""
68+
for sha in $(git rev-list "$RANGE"); do
69+
if git log -1 --format='%B' "$sha" | grep -Eq "$PATTERN"; then
70+
offenders="$offenders $sha"
71+
fi
72+
done
73+
74+
if [ -n "$offenders" ]; then
75+
echo "❌ Found Gerrit Change-Id trailer in the following commit(s):"
76+
for sha in $offenders; do
77+
subject=$(git log -1 --format='%h %s' "$sha")
78+
echo " - $subject"
79+
done
80+
echo ""
81+
echo "These Change-Id lines come from the Gerrit commit-msg hook and must"
82+
echo "not be pushed to this branch. Remove them, e.g.:"
83+
echo ""
84+
echo " git rebase -i <base> --exec \\"
85+
echo " 'git commit --amend -m \"\$(git log -1 --format=%B | sed \"/^Change-Id: /d\")\"'"
86+
echo ""
87+
echo "or for the tip commit only:"
88+
echo ""
89+
echo " git commit --amend -m \"\$(git log -1 --format=%B | sed '/^Change-Id: /d')\""
90+
exit 1
91+
fi
92+
93+
echo "✅ No Change-Id trailers found."

0 commit comments

Comments
 (0)