From e89003fcc2e500838628f6655cacca234dbe5d86 Mon Sep 17 00:00:00 2001 From: Claude Date: Mon, 15 Jun 2026 17:59:59 +0000 Subject: [PATCH 1/3] ci: enforce Conventional Commits on commits and PR titles Add commitlint (config-conventional) on each PR commit and a PR-title check (the squash subject that feeds release-please). Implements ADR-0002. https://claude.ai/code/session_01EESGRwTzyd1G16yv7R2Eqd --- .github/workflows/commitlint.yml | 26 ++++++++++++++++++++++++++ .github/workflows/lint-pr-title.yml | 28 ++++++++++++++++++++++++++++ commitlint.config.mjs | 3 +++ 3 files changed, 57 insertions(+) create mode 100644 .github/workflows/commitlint.yml create mode 100644 .github/workflows/lint-pr-title.yml create mode 100644 commitlint.config.mjs diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml new file mode 100644 index 0000000..c1f565f --- /dev/null +++ b/.github/workflows/commitlint.yml @@ -0,0 +1,26 @@ +name: commitlint + +# Enforce Conventional Commits on every commit in a PR (ADR-0002). + +on: + pull_request: + branches: + - master + +permissions: + contents: read + +concurrency: + group: ${{ github.workflow }}-${{ github.ref }} + cancel-in-progress: true + +jobs: + commitlint: + runs-on: ubuntu-22.04 + steps: + - uses: actions/checkout@v4 + with: + fetch-depth: 0 + - uses: wagoid/commitlint-github-action@v6 + with: + configFile: commitlint.config.mjs diff --git a/.github/workflows/lint-pr-title.yml b/.github/workflows/lint-pr-title.yml new file mode 100644 index 0000000..0ec1cb8 --- /dev/null +++ b/.github/workflows/lint-pr-title.yml @@ -0,0 +1,28 @@ +name: lint-pr-title + +# The PR title becomes the squash-merge subject and feeds the release-please +# changelog, so it must be a valid Conventional Commit (ADR-0002). + +on: + pull_request: + branches: + - master + types: + - opened + - edited + - synchronize + +permissions: + pull-requests: read + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} + cancel-in-progress: true + +jobs: + lint-pr-title: + runs-on: ubuntu-22.04 + steps: + - uses: amannn/action-semantic-pull-request@v5 + env: + GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} diff --git a/commitlint.config.mjs b/commitlint.config.mjs new file mode 100644 index 0000000..b29b5ae --- /dev/null +++ b/commitlint.config.mjs @@ -0,0 +1,3 @@ +export default { + extends: ["@commitlint/config-conventional"], +}; From c09888ac00789fee7765b7b7a484b2f149097344 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 18 Jun 2026 10:41:40 +0000 Subject: [PATCH 2/3] ci: use commitlint as the single engine, official actions only Rework per maintainer review (#121): drop the third-party wagoid/commitlint-github-action and amannn/action-semantic-pull-request. One workflow runs commitlint (the @commitlint/* packages) on both the PR commits and the PR title, via official actions/checkout + actions/setup-node. commitlint.config.mjs stays the single rule source. Still implements ADR-0002. https://claude.ai/code/session_01EESGRwTzyd1G16yv7R2Eqd --- .github/workflows/lint-pr-title.yml | 28 ---------------------------- 1 file changed, 28 deletions(-) delete mode 100644 .github/workflows/lint-pr-title.yml diff --git a/.github/workflows/lint-pr-title.yml b/.github/workflows/lint-pr-title.yml deleted file mode 100644 index 0ec1cb8..0000000 --- a/.github/workflows/lint-pr-title.yml +++ /dev/null @@ -1,28 +0,0 @@ -name: lint-pr-title - -# The PR title becomes the squash-merge subject and feeds the release-please -# changelog, so it must be a valid Conventional Commit (ADR-0002). - -on: - pull_request: - branches: - - master - types: - - opened - - edited - - synchronize - -permissions: - pull-requests: read - -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number }} - cancel-in-progress: true - -jobs: - lint-pr-title: - runs-on: ubuntu-22.04 - steps: - - uses: amannn/action-semantic-pull-request@v5 - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} From b72048abb3652d289fb93e39abdc48cf5ebfc081 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 18 Jun 2026 10:42:00 +0000 Subject: [PATCH 3/3] ci: rewrite commitlint workflow to single-engine commitlint The previous commit only removed lint-pr-title.yml; this carries the reworked commitlint.yml (official actions + commitlint for commits and PR title). Implements ADR-0002 per the #121 review. https://claude.ai/code/session_01EESGRwTzyd1G16yv7R2Eqd --- .github/workflows/commitlint.yml | 37 +++++++++++++++++++++++++++----- 1 file changed, 32 insertions(+), 5 deletions(-) diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index c1f565f..86bae16 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -1,26 +1,53 @@ name: commitlint -# Enforce Conventional Commits on every commit in a PR (ADR-0002). +# Validate Conventional Commits (ADR-0002) with commitlint as the SINGLE engine, +# on both the PR commits and the PR title (the squash-merge subject that feeds +# release-please). Only official actions/* + the @commitlint/* packages — no +# third-party actions (supply-chain hardening; Phase 4/5 orientation). on: pull_request: branches: - master + types: + - opened + - edited + - synchronize + - reopened permissions: contents: read concurrency: - group: ${{ github.workflow }}-${{ github.ref }} + group: ${{ github.workflow }}-${{ github.event.pull_request.number }} cancel-in-progress: true jobs: commitlint: runs-on: ubuntu-22.04 steps: - - uses: actions/checkout@v4 + # TODO(supply-chain): pin actions to commit SHA — via Renovate digest + # pinning once #122 lands, or provide the SHAs to pin manually (ADR-0002 / #99). + - name: Checkout + uses: actions/checkout@v4 with: fetch-depth: 0 - - uses: wagoid/commitlint-github-action@v6 + + - name: Set up Node.js + uses: actions/setup-node@v4 with: - configFile: commitlint.config.mjs + node-version: 20 + + - name: Install commitlint + run: npm install --no-save @commitlint/cli @commitlint/config-conventional + + - name: Lint PR commits + env: + BASE_SHA: ${{ github.event.pull_request.base.sha }} + HEAD_SHA: ${{ github.event.pull_request.head.sha }} + run: npx commitlint --from "$BASE_SHA" --to "$HEAD_SHA" --verbose + + - name: Lint PR title + env: + PR_TITLE: ${{ github.event.pull_request.title }} + run: printf '%s' "$PR_TITLE" | npx commitlint --verbose