PR Quality #9

	name: PR Quality Gate

	# 🔒 SECURITY: Use manual trigger only for self-hosted runners
	# This prevents forks from automatically running code on your machine
	on:
	workflow_dispatch:
	inputs:
	branch:
	description: 'Branch to check'
	required: true
	default: 'main'

	jobs:
	pr-quality:
	runs-on: self-hosted

	steps:
	- name: Cleanup Workspace
	run: rm -rf ./*

	- name: Checkout code
	uses: actions/checkout@v4
	with:
	ref: ${{ inputs.branch }}
	fetch-depth: 0

	- name: Setup Node.js
	uses: actions/setup-node@v4
	with:
	node-version: "20.x"
	cache: "npm"

	- name: Install dependencies (Safe Mode)
	# 🛡️ SECURITY: --ignore-scripts prevents malicious postinstall scripts
	# from executing on your local machine.
	run: npm ci --ignore-scripts

	- name: Check for large files
	run: \|
	echo "🔍 Scanning for large files (>1MB)..."
	find . -type f -size +1M -not -path "./node_modules/" -not -path "./.git/" \| while read file; do
	echo "::warning::Large file detected: $file ($(du -h "$file" \| cut -f1))"
	done

	- name: Lint commit messages
	run: \|
	echo "🔍 Verifying Conventional Commits..."
	if git rev-parse --verify HEAD~1 >/dev/null 2>&1; then
	git log --oneline HEAD~1..HEAD \| while read line; do
	if [[ ! "$line" =~ ^[a-f0-9]+\ (feat\|fix\|docs\|style\|refactor\|test\|chore\|perf\|ci)($.+$)?: ]]; then
	echo "::warning::Invalid Commit Message: $line"
	echo "::warning::Format should be: type(scope): description"
	fi
	done
	fi

Provide feedback