Skip to content

chore: validate Dependabot commits instead of skipping them #22

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
robinbowes merged 3 commits into from
Aug 11, 2026
Merged

chore: validate Dependabot commits instead of skipping them #22

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1596f98
chore: validate Dependabot commits instead of skipping them
robinbowes Aug 11, 2026
33ab896
chore: re-pin the commitlint action to a digest-pinned fork
robinbowes Aug 11, 2026
9aede2b
chore(deps): pin the commit prefix for every Dependabot ecosystem
robinbowes Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 15 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,11 @@ updates:
interval: "weekly"
cooldown:
default-days: 7
# Pin the prefix rather than relying on Dependabot's auto-detection, so
# its commits satisfy commitlint now that they are no longer ignored.
commit-message:
prefix: "chore"
include: "scope"

@yo61-lastlight yo61-lastlight Bot Aug 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Important] Prefix pin covers only the pre-commit ecosystem

The commit-message.prefix override is added only to the pre-commit block. uv (line ~19) and github-actions (line ~30) still have no commit-message config, so their first bump PRs still rely on Dependabot's auto-detected prefix — the exact thing this PR's own comment says not to rely on now that commitlint is enforced on every Dependabot commit. Both ecosystems are new (added in #21) with no bump commits yet, so auto-detection has no ecosystem-specific precedent to key off; if it falls back to an unprefixed subject ("Bump foo from 1 to 2"), that fails commitlint's type-enum/subject-empty rules and the first uv/actions Dependabot PR breaks CI. Add the same commit-message: {prefix: ..., include: scope} to the uv and github-actions blocks (e.g. chore/ci respectively) rather than leaving two of three ecosystems on auto-detection.

groups:
hooks:
patterns: ["*"]
Expand All @@ -18,6 +23,11 @@ updates:
interval: "weekly"
cooldown:
default-days: 7
# Pin the prefix rather than relying on Dependabot's auto-detection, so
# its commits satisfy commitlint now that they are no longer ignored.
commit-message:
prefix: "chore"
include: "scope"
groups:
uv-minor-patch:
update-types: ["minor", "patch"]
Expand All @@ -30,6 +40,11 @@ updates:
interval: "weekly"
cooldown:
default-days: 7
# Pin the prefix rather than relying on Dependabot's auto-detection, so
# its commits satisfy commitlint now that they are no longer ignored.
commit-message:
prefix: "chore"
include: "scope"
groups:
actions-minor-patch:
update-types: ["minor", "patch"]
5 changes: 3 additions & 2 deletions .github/workflows/ci.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -75,8 +75,9 @@ jobs:
fetch-depth: 0
# Fork of wagoid/commitlint-github-action. Upstream is unmaintained: no
# commit to master since 2025-01-14, and it pins @commitlint/ensure ^19,
# two majors behind. This fork runs commitlint v21 on node 24.
- uses: yo61/commitlint-github-action@31e5e0454fc0709625e6dcfb502ea18978f45f15 # v6.3.0
# two majors behind. This fork runs commitlint v21 on node 24, and pins its
# runtime image by digest so the SHA pin here cannot be worked around.
- uses: yo61/commitlint-github-action@501ff7bb31eb7133c871318c877d0e43cd1ff500 # v6.3.0 (digest-pinned)

zizmor:
name: zizmor
Expand Down
4 changes: 0 additions & 4 deletions commitlint.config.mjs
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,3 @@
export default {
extends: ["@commitlint/config-conventional"],
// Dependabot auto-generates commit bodies with long markdown URLs that exceed
// body-max-line-length. It won't wrap them, so skip linting its commits while
// keeping the full ruleset enforced for human authors.
ignores: [(message) => message.includes("Signed-off-by: dependabot[bot]")],

@yo61-lastlight yo61-lastlight Bot Aug 11, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[Critical] Exemption removed without switching CI to a commitlint that has the URL exemption

This repo's .github/workflows/ci.yaml still runs wagoid/commitlint-github-action@b948419 (v6.2.1), whose package.json pins @commitlint/ensure ^19.0.3 — that's the version the PR says predates the URL-line exemption. @commitlint/config-conventional also enables body-max-line-length at 100 by default (the earlier 200-char override was already dropped in f1bddcd), so it's even stricter than the pre-#16 baseline. Removing the ignores here without also pointing CI at yo61/commitlint-github-action (as yo61/agent-team-topologies does, cited in the PR body as the live proof) means the next Dependabot PR whose body has a long changelog/compare URL — a routine occurrence, as seen in this repo's own #18/#19 — will fail commitlint in CI. The verification in the PR description was run against a different action/repo than the one this diff actually ships to. The fix belongs in .github/workflows/ci.yaml — swap the wagoid/commitlint-github-action step for yo61/commitlint-github-action@v6.3.0 (or otherwise get ensure>=20 into this repo's CI) in the same commit that drops this exemption.

};