ci: validate commit messages instead of PR title - #18699
Draft
Christopher Co (christopherco) wants to merge 1 commit into
Draft
ci: validate commit messages instead of PR title#18699Christopher Co (christopherco) wants to merge 1 commit into
Christopher Co (christopherco) wants to merge 1 commit into
Conversation
Copilot started reviewing on behalf of
Christopher Co (christopherco)
September 3, 2026 03:19
View session
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The workflow lacks checkout permission and exposes a write-capable token to unlocked dependencies, while its local reproduction commands are incomplete.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Replaces PR-title linting with per-commit Conventional Commit validation.
Changes:
- Adds shared commitlint configuration.
- Adds commit-validation workflow and contributor guidance.
- Removes the former PR-title workflow.
File summaries
| File | Description |
|---|---|
CONTRIBUTING.md |
Documents local commit validation. |
commitlint.config.js |
Defines shared commit-message rules. |
.github/workflows/check-pr-title.yml |
Removes PR-title validation. |
.github/workflows/check-commit-messages.yml |
Validates and reports invalid PR commits. |
Review details
- Files reviewed: 4/4 changed files
- Comments generated: 8
- Review effort level: Balanced
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| if: github.repository == 'microsoft/azurelinux' | ||
| runs-on: ubuntu-latest | ||
| permissions: | ||
| pull-requests: write # Needed to post comments on PR |
| # Install commitlint into the workspace root so commitlint.config.js can | ||
| # resolve its `extends`. Pinned to keep the ruleset reproducible. | ||
| - name: Install commitlint | ||
| run: npm install --no-save --no-audit --no-fund @commitlint/cli@21.2.2 @commitlint/config-conventional@21.2.2 |
Comment on lines
+117
to
+125
| const workspace = process.env.GITHUB_WORKSPACE; | ||
| const commitlintBin = path.join(workspace, 'node_modules', '.bin', 'commitlint'); | ||
| const lintMessage = (message) => { | ||
| try { | ||
| execFileSync(commitlintBin, ['--config', 'commitlint.config.js'], { | ||
| input: message, | ||
| cwd: workspace, | ||
| stdio: ['pipe', 'pipe', 'pipe'], | ||
| }); |
Comment on lines
+124
to
+125
| stdio: ['pipe', 'pipe', 'pipe'], | ||
| }); |
Comment on lines
+150
to
+152
| const list = invalid | ||
| .map((c) => `- \`${c.sha}\` <code>${encodeSubject(c.subject)}</code>`) | ||
| .join('\n'); |
| You can reproduce this check locally with the same rules: | ||
|
|
||
| ``` | ||
| npx --yes @commitlint/cli@21 --from origin/4.0 --to HEAD |
Comment on lines
+136
to
+140
| # Lint every commit on your branch that isn't on the target branch: | ||
| npx --yes @commitlint/cli@21 --from origin/4.0 --to HEAD | ||
|
|
||
| # Or check a single message: | ||
| echo "feat(demo): add capability" | npx --yes @commitlint/cli@21 |
Comment on lines
+8
to
+12
| // Validate locally (same rules as CI): | ||
| // npx --yes @commitlint/cli@21 --config commitlint.config.js \ | ||
| // --from origin/4.0 --to HEAD | ||
| // or lint a single message: | ||
| // echo "feat(demo): add capability" | npx --yes @commitlint/cli@21 |
We rebase-merge, so every commit enters the permanent 4.0 history. The old check only validated the PR title, which could hide non-conventional commits behind a conventional title (or fail a well-formed branch behind a descriptive one). Validate the header of every commit with commitlint instead. The rules live in commitlint.config.js so CI and local runs share one source of truth: contributors can reproduce the check with `npm ci` + `npm run commitlint`, and it can later back pre-commit hooks. A github-script step reads the PR commits via the API and lints each against the shared config, allowing optional scopes and breaking-change markers. On failure it comments the offending commits and how to fix them, and removes the comment once all are valid. commitlint and its full dependency tree are pinned via package.json and a committed package-lock.json, installed with `npm ci`, so the ruleset is reproducible and the workflow avoids ad-hoc package installation. The workflow stays on pull_request_target so it can comment on fork PRs. It checks out only the base branch for the config, reads commit metadata through the API, and feeds those messages to commitlint as data -- it never checks out or runs PR code. Commit subjects are HTML-encoded before display, the count is checked against the PR total to fail closed on the 250-commit API cap, and all actions remain SHA-pinned. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 886c4e30-30d0-448a-9180-5c4a0ee8018c
Christopher Co (christopherco)
force-pushed
the
chrco/fix-conventional-commit-checker-v2
branch
from
September 3, 2026 04:54
3db8dd3 to
942538a
Compare
Copilot started reviewing on behalf of
Christopher Co (christopherco)
September 3, 2026 04:54
View session
Contributor
There was a problem hiding this comment.
🟡 Changes recommended
The workflow will not activate from 4.0 alone and is missing the contents permission required for checkout.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
Suppressed comments (1)
.github/workflows/check-commit-messages.yml:47
- The job overrides token permissions with only
pull-requests: write, but the checkout step uses the defaultgithub.token;actions/checkoutrequirescontents: readfor reliable repository access. Without it, the job can fail before loading the commitlint config. Grant read-only contents access alongside the existing PR permission.
permissions:
pull-requests: write # Needed to post comments on PR
- Files reviewed: 5/7 changed files
- Comments generated: 1
- Review effort level: Balanced
Comment on lines
+19
to
+20
| on: | ||
| pull_request_target: # zizmor: ignore[dangerous-triggers] |
| @@ -0,0 +1,40 @@ | |||
| // Shared Conventional Commits rules for Azure Linux. | |||
Collaborator
Author
There was a problem hiding this comment.
Not sure if commitlint config and the package.json/package-lock.json (for zizmor check) should really live in root or be in a subdir under .github/
Only requirement is that all 3 files stay together.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We rebase-merge, so every commit enters the permanent 4.0 history. The old check only validated the PR title, which could hide non-conventional commits behind a conventional title (or fail a well-formed branch behind a descriptive one).
Validate the header of every commit with commitlint instead. The rules live in commitlint.config.js so CI and local runs share one source of truth: contributors can reproduce the check with
npx @commitlint/cli, and it can later back pre-commit hooks. A github-script step reads the PR commits via the API and lints each against the shared config, allowing optional scopes and breaking-change markers. On failure it comments the offending commits and how to fix them, and removes the comment once all are valid.The workflow stays on pull_request_target so it can comment on fork PRs. It checks out only the base branch for the config, reads commit metadata through the API, and feeds those messages to commitlint as data -- it never checks out or runs PR code. Commit subjects are HTML-encoded before display, the count is checked against the PR total to fail closed on the 250-commit API cap, and all actions remain SHA-pinned.
Fixes: AB#22437