pr-quality.yml

name: PR Quality Gate

# 🔒 SECURITY: Use manual trigger only for self-hosted runners
# This prevents forks from automatically running code on your machine
on:
  workflow_dispatch:
    inputs:
      branch:
        description: 'Branch to check'
        required: true
        default: 'main'

jobs:
  pr-quality:
    runs-on: self-hosted
    
    steps:
    - name: Cleanup Workspace
      run: rm -rf ./*
      
    - name: Checkout code
      uses: actions/checkout@v4
      with:
        ref: ${{ inputs.branch }}
        fetch-depth: 0
    
    - name: Setup Node.js
      uses: actions/setup-node@v4
      with:
        node-version: "20.x"
        cache: "npm"
    
    - name: Install dependencies (Safe Mode)
      # 🛡️ SECURITY: --ignore-scripts prevents malicious postinstall scripts
      # from executing on your local machine.
      run: npm ci --ignore-scripts
    
    - name: Check for large files
      run: |
        echo "🔍 Scanning for large files (>1MB)..."
        find . -type f -size +1M -not -path "./node_modules/*" -not -path "./.git/*" | while read file; do
          echo "::warning::Large file detected: $file ($(du -h "$file" | cut -f1))"
        done
    
    - name: Lint commit messages
      run: |
        echo "🔍 Verifying Conventional Commits..."
        if git rev-parse --verify HEAD~1 >/dev/null 2>&1; then
          git log --oneline HEAD~1..HEAD | while read line; do
            if [[ ! "$line" =~ ^[a-f0-9]+\ (feat|fix|docs|style|refactor|test|chore|perf|ci)(\(.+\))?: ]]; then
              echo "::warning::Invalid Commit Message: $line"
              echo "::warning::Format should be: type(scope): description"
            fi
          done
        fi