ci: Bump the codeql-action group across 1 directory with 3 updates #529
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: commit-lint | |
| # Lint every non-merge commit of a pull request against the repository's commit | |
| # convention (CONTRIBUTING.md), using the same script as the local commit-msg | |
| # hook. A bypassed local hook (`git commit --no-verify`) is caught here. | |
| on: | |
| pull_request: | |
| permissions: | |
| contents: read | |
| jobs: | |
| commit-lint: | |
| name: Conventional commits | |
| runs-on: ubuntu-latest | |
| # Message linting is seconds; cap a stuck runner. | |
| timeout-minutes: 10 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7 | |
| with: | |
| # Need the PR's commits, so fetch full history rather than a shallow tip. | |
| fetch-depth: 0 | |
| - name: Lint the pull request commits | |
| env: | |
| BASE_SHA: ${{ github.event.pull_request.base.sha }} | |
| HEAD_SHA: ${{ github.event.pull_request.head.sha }} | |
| shell: bash | |
| run: | | |
| set -euo pipefail | |
| echo "Linting non-merge commits in ${BASE_SHA}..${HEAD_SHA}" | |
| # --no-merges: merge commits are generated by GitHub and are exempt. | |
| commits="$(git rev-list --no-merges "${BASE_SHA}..${HEAD_SHA}")" | |
| if [ -z "${commits}" ]; then | |
| echo "No non-merge commits to lint." | |
| exit 0 | |
| fi | |
| status=0 | |
| for sha in ${commits}; do | |
| echo "── $(git log -1 --format='%h %s' "${sha}")" | |
| # Dependabot writes its own mechanical `bump …` headers (their length is | |
| # driven by the package name, so a long name alone can overrun the 72-char | |
| # limit) and cannot amend them. They are generated by a trusted bot, not a | |
| # contributor, so exempt them here rather than let routine dependency PRs | |
| # fail the lint. Identify the bot by its commit author, which a human | |
| # commit never carries. If Claude's dependabot-autofix triage later rewrites | |
| # such a message, the author changes and the rewrite is linted normally. | |
| author_email="$(git log -1 --format='%ae' "${sha}")" | |
| case "$author_email" in | |
| *dependabot*) | |
| echo " skipped (Dependabot-authored)" | |
| continue | |
| ;; | |
| esac | |
| if git log -1 --format=%B "${sha}" | tools/commit-lint/lint-commit-message.sh --ci -; then | |
| echo " ok" | |
| else | |
| status=1 | |
| fi | |
| done | |
| if [ "${status}" -ne 0 ]; then | |
| echo | |
| echo "One or more commit messages do not follow CONTRIBUTING.md." | |
| echo "Fix them with an interactive rebase (git rebase -i) before merge." | |
| fi | |
| exit "${status}" |