commit-msg-check.yml

name: Commit message check

on:
  push:
    branches: [main]
  pull_request:

permissions:
  contents: read

jobs:
  check:
    name: reject duplicate version stamps
    runs-on: ubuntu-latest
    timeout-minutes: 2

    steps:
      - name: Checkout
        uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - name: Validate commit messages
        env:
          BEFORE_SHA: ${{ github.event.before }}
          AFTER_SHA: ${{ github.event.after }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          if [ -n "${PR_HEAD_SHA:-}" ] && [ -n "${PR_BASE_SHA:-}" ]; then
            range="${PR_BASE_SHA}..${PR_HEAD_SHA}"
          elif [ "${BEFORE_SHA:-}" = "0000000000000000000000000000000000000000" ] || [ -z "${BEFORE_SHA:-}" ]; then
            range="${AFTER_SHA}~1..${AFTER_SHA}"
          else
            range="${BEFORE_SHA}..${AFTER_SHA}"
          fi

          pattern='\([0-9]{4}\.[0-9]+\.[0-9]+\.[0-9]+(-[A-Fa-f0-9]{4})?\)'
          failures=0
          while IFS= read -r line; do
            sha="${line%% *}"
            subject="${line#* }"
            count=$( ( printf '%s\n' "$subject" | grep -oE "$pattern" || true ) | grep -c . || true )
            count=${count//[^0-9]/}
            count=${count:-0}
            if [ "$count" -gt 1 ]; then
              echo "::error::Commit $sha has $count build-version stamps: $subject"
              failures=$((failures + 1))
            fi
          done < <(git log --format='%H %s' "$range")

          if [ "$failures" -gt 0 ]; then
            exit 1
          fi