ci: use a maintained commitlint action fork - #198
Conversation
|
|
![yo61-lastlight[bot]](https://avatars.githubusercontent.com/u/5678240?s=60&v=4){kind=small}
There was a problem hiding this comment.
Replaces the stale wagoid/commitlint-github-action (pinned @commitlint/ensure ^19) with a direct, version-pinned npx commitlint invocation (@commitlint/cli@21.2.1 + @commitlint/config-conventional@21.2.0) matching the pre-commit hook's v21 resolution. The base/head SHA range comes from the pull_request event payload, checkout already has fetch-depth: 0 so both SHAs are reachable, and permissions are correctly narrowed to contents: read now that commits are read from local git instead of the API. Verified against the diff: no correctness or security issues found.
|
|
There was a problem hiding this comment.
Replaces wagoid/commitlint-github-action with a version-pinned direct commitlint run (@commitlint/cli@21.2.1 + config-conventional@21.2.0) plus a tracked npm manifest in .github/commitlint and a matching Dependabot entry. Verified: version pins in package-lock.json match package.json exactly; the lint step's config path and the binary's relative path both resolve correctly against the repo-root working directory; job permissions correctly narrow to contents: read (needed for local git history + npm ci) now that pull-requests: read is no longer needed; the new npm-install-on-PR pattern mirrors the existing docs.yaml job (same setup-node SHA pin, same contents: read scope), so it isn't a new class of exposure for this repo. A prior last-light[bot] review on an earlier commit (before the package-lock.json manifest was added) also found no issues and was since dismissed by the new push; this is a fresh look at the current head and I agree with that assessment. No Critical or Important findings.
619f264 to
1a0baac
Compare
wagoid/commitlint-github-action pins @commitlint/ensure ^19. The exemption for long lines containing a URL landed in v20, so CI enforced a stricter rule than the config intended and failed Dependabot commits on body-max-line-length, while the pre-commit hook resolving v21 passed the same commit. Upstream is unmaintained: master has had no commit since 2025-01-14 and the v20 bump has sat open since July. Point at yo61/commitlint-github-action instead, which runs commitlint v21 on node 24 and is published to ghcr.io.
robinbowes
changed the title
1a0baac to
199d8b3
Compare
|
|
There was a problem hiding this comment.
Swaps the unmaintained wagoid/commitlint-github-action (pinned @commitlint/ensure ^19, missing the v20 URL exemption for body-max-line-length) for the SHA-pinned yo61/commitlint-github-action@v6.3.0 fork on commitlint v21/Node 24. Verified the pinned SHA (31e5e045...) is the actual head of the fork's master/v6.3.0 tag and that the fork's action.yml matches upstream's shape (same docker-image-by-tag pattern as wagoid's own action, so no new mutability risk introduced), the job's permissions (pull-requests: read, plus workflow-level contents: read) are unchanged and still appropriate, and CI is green on this head SHA. One point worth the author's attention, not a blocker: commitlint.config.mjs already carries an ignores clause that skips all commitlint rules for any commit whose message contains "Signed-off-by: dependabot[bot]" (added in #145, predates this PR) — which on its face should already exempt the exact body-max-line-length failures this PR describes, independent of the action version. Worth confirming in the PR body whether that ignore doesn't reliably match the failing commits (e.g. a squashed/individual commit lacking the trailer) rather than leaving the reader to reconcile the two mitigations. No code issue with the diff itself.
1 participant
What
Points the commitlint job at
yo61/commitlint-github-action— a maintained fork running commitlint v21 on Node 24.Why
Dependabot PRs fail the commitlint job on
body-max-line-length, while the pre-commitlintjob passes the same commit. Same commit, samecommitlint.config.mjs, different verdict.@commitlint/ensurev20 added an exemption for long lines containing a URL:wagoid/commitlint-github-action@v6.2.1is the latest release and pins@commitlint/ensure: ^19.0.3, so CI enforced a stricter rule than the config intends. Dependabot bodies are markdown link lists — one real example is 314 characters on a single line.Upstream is unmaintained: no commit to
mastersince 2025-01-14, and the v20 bump (PR #837) has been open and mergeable since July with no response.The fork
yo61/commitlint-github-action@v6.3.0— all@commitlint/*at^21, Node 24.19.0 LTS (v21 needsnode >= 22.12),commitlint-plugin-function-rulesat^5(v4's peer range caps at<20and breaksnpm ci), published toghcr.iofrom a pushed tag. Actions SHA-pinned, least-privilege permissions,actionlintandzizmorclean.Verified against the action's own load+lint path with a real
commitlint.config.mjs:subject-case: [0].mjsoverride is honoredCommit subjects stay validated for Dependabot as well as humans, rather than exempting bot commits.