Skip to content

ci: lint commits and PR title with commitlint (Phase 1)#121

Merged
bgauduch merged 3 commits into
masterfrom
ci/phase-1-commitlint
Jul 1, 2026
Merged

ci: lint commits and PR title with commitlint (Phase 1)#121
bgauduch merged 3 commits into
masterfrom
ci/phase-1-commitlint

Conversation

@bgauduch

@bgauduch bgauduch commented Jun 15, 2026

Copy link
Copy Markdown
Owner

Summary

Roadmap Phase 1 — enforce Conventional Commits (ADR-0002) using commitlint as the single rule engine, on both the PR commits and the PR title.

Changes

  • commitlint.config.mjs — extends @commitlint/config-conventional (the single source of the rules).
  • .github/workflows/commitlint.yml — one workflow that, using only official actions/* + the @commitlint/* packages:
    • lints every commit in the PR (commitlint --from $BASE_SHA --to $HEAD_SHA),
    • lints the PR title (the squash-merge subject that feeds release-please).

Design — "Option B" (no third-party actions)

Drops wagoid/commitlint-github-action and amannn/action-semantic-pull-request in favour of running commitlint directly. One engine, one ruleset (commitlint.config.mjs), smaller supply-chain surface — and no parser drift between two tools. The PR title is the load-bearing check (it becomes the squash subject); per-commit linting is kept for a tidy PR history.

ADR

No new ADR — implements existing ADR-0002. adr-not-needed applied (touches .github/workflows/).

Follow-up

Add commitlint (config-conventional) on each PR commit and a PR-title
check (the squash subject that feeds release-please). Implements ADR-0002.

https://claude.ai/code/session_01EESGRwTzyd1G16yv7R2Eqd
@bgauduch bgauduch added the adr-not-needed Reviewer-confirmed: no ADR required (bypasses adr-check) label Jun 15, 2026 — with Claude

Copy link
Copy Markdown
Owner Author

Décision de review — passer en « Option B » (commitlint seul, actions officielles)

Après discussion avec le mainteneur, on remplace l'approche actuelle (deux actions tierces) par une implémentation DIY qui n'utilise que des actions officielles actions/* et commitlint comme unique moteur.

Pourquoi

  • Deux moteurs aujourd'hui : wagoid/commitlint-github-action (lint des commits) et amannn/action-semantic-pull-request (lint du titre). amannn n'utilise pas commitlint sous le capot → deux parsers, risque de divergence de règles pour « la même » convention.
  • Supply-chain : commitlint ne fournit pas d'action GitHub officielle ; wagoid/amannn sont des standards de-facto mais tiers. On préfère ne dépendre que des actions/* officielles + des paquets npm @commitlint/* (l'outil lui-même).
  • Squash-merge (ADR-0002) : seul le titre de PR devient le commit sur master et nourrit release-please. C'est le check qui porte ; le lint par commit reste un confort.

Cible (Option B)

  • Supprimer wagoid/commitlint-github-action et amannn/action-semantic-pull-request.
  • Un seul workflow : actions/checkout + actions/setup-node, puis commitlint pour :
    1. les commits de la PR — npx commitlint --from <base.sha> --to <head.sha> --verbose
    2. le titre de la PR — echo "$PR_TITLE" | npx commitlint --verbose
  • Conserver commitlint.config.mjs (extends: @commitlint/config-conventional) comme source unique des règles.
  • Pin des actions par SHA (durcissement supply-chain, reco GitHub/OpenSSF), permissions: au minimum, concurrency:.

Rattachement roadmap

Implémente toujours ADR-0002 (donc label adr-not-needed), avec une orientation Phase 4 (CI hardening) / Phase 5 (supply-chain, #99).

La mise en œuvre se fera dans une session dédiée à cette branche (ci/phase-1-commitlint).


Posté à la demande du mainteneur.


Generated by Claude Code

claude added 2 commits June 18, 2026 10:41
Rework per maintainer review (#121): drop the third-party
wagoid/commitlint-github-action and amannn/action-semantic-pull-request.
One workflow runs commitlint (the @commitlint/* packages) on both the PR
commits and the PR title, via official actions/checkout + actions/setup-node.
commitlint.config.mjs stays the single rule source. Still implements ADR-0002.

https://claude.ai/code/session_01EESGRwTzyd1G16yv7R2Eqd
The previous commit only removed lint-pr-title.yml; this carries the
reworked commitlint.yml (official actions + commitlint for commits and
PR title). Implements ADR-0002 per the #121 review.

https://claude.ai/code/session_01EESGRwTzyd1G16yv7R2Eqd

Copy link
Copy Markdown
Owner Author

Done — reworked to Option B (commit b72048a):

  • Removed wagoid/commitlint-github-action and amannn/action-semantic-pull-request.
  • Single commitlint.yml: actions/checkout + actions/setup-node + @commitlint/{cli,config-conventional}, linting both the PR commits (commitlint --from <base> --to <head>) and the PR title (printf '%s' "$PR_TITLE" | commitlint).
  • commitlint.config.mjs stays the single rule source. permissions: contents: read, concurrency: set.
  • Still implements ADR-0002 (adr-not-needed).

⚠️ One open item: SHA-pinning the two actions/* is left as @v4 + a TODO — I can't resolve commit digests from this sandbox (no network). Two options:

  1. you paste the two SHAs and I pin them, or
  2. let Renovate pin digests automatically once chore: extend Renovate and retire Dependabot (Phase 1) #122 lands (add the helpers:pinGitHubActionDigests preset to renovate.json).

Which do you prefer?


Generated by Claude Code

@bgauduch bgauduch changed the title ci: enforce Conventional Commits on commits and PR titles (Phase 1) ci: lint commits and PR title with commitlint (Phase 1) Jun 28, 2026
@bgauduch bgauduch merged commit 8b4899b into master Jul 1, 2026
4 checks passed
@bgauduch bgauduch deleted the ci/phase-1-commitlint branch July 1, 2026 21:31
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

adr-not-needed Reviewer-confirmed: no ADR required (bypasses adr-check)

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants