commit-lint.yml

name: Commit lint

# Enforces the commit-message convention (see the Contributing wiki page) with
# gitlint. Runs on pushes to master (the maintainer's trunk-based flow) and on
# pull requests (contributors). Only the new commits in the range are linted,
# never the whole history, so pre-convention commits are never re-flagged.

on:
  push:
    branches: [master]
  pull_request:

# Least-privilege GITHUB_TOKEN: this workflow only reads the repo to lint the
# commit range; it writes nothing. Without an explicit block it would inherit
# the repository/organization default, which may be broader (#230).
permissions:
  contents: read

jobs:
  commit-lint:
    name: Lint commit messages
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0          # need the full range to lint commits
      - uses: actions/setup-python@v7
        with:
          python-version: "3.12"
      # gitlint-core, not the `gitlint` meta-package: the latter pulls
      # gitlint-core[trusted-deps], which hard-pins the vulnerable click 8.1.3 /
      # sh 1.14.3 (see the [dev] extra in pyproject.toml for the advisories).
      # gitlint-core ships the same `gitlint` console script, and its loose deps
      # let pip take the patched click/sh.
      - run: pip install "gitlint-core==0.19.1"
      - name: Lint commit messages
        run: |
          if [ "${{ github.event_name }}" = "pull_request" ]; then
            range="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
          elif [ "${{ github.event.before }}" = "0000000000000000000000000000000000000000" ]; then
            range="HEAD~1..HEAD"   # new branch / first push: lint the tip commit
          else
            range="${{ github.event.before }}..${{ github.sha }}"
          fi
          echo "Linting commit range: $range"
          gitlint --commits "$range"