diff --git a/.github/workflows/check-commit-messages.yml b/.github/workflows/check-commit-messages.yml new file mode 100644 index 00000000000..8298079f84c --- /dev/null +++ b/.github/workflows/check-commit-messages.yml @@ -0,0 +1,171 @@ +# +# Validates that every commit entering the permanent 4.0 history through +# rebase-merge follows the Conventional Commits header format documented in +# CONTRIBUTING.md. +# +# Workflows that run on 'pull_request_target' trigger need to be carefully +# reviewed since they run in the context of the PR target and consume unvalidated +# input controlled by a PR submitter. We've reviewed this workflow and +# allow-listed it via the 'zizmor' comment below. This workflow reads commit +# metadata exclusively through the GitHub API and never checks out or executes +# any code from the PR branch, so it is safe to use pull_request_target. +# + +name: "Check Commit Messages" + +on: + pull_request_target: # zizmor: ignore[dangerous-triggers] + # Only run on PRs targeting 4.0. pull_request_target always uses the workflow + # from the default branch. This workflow does not require any untrusted + # scripts from the PR branch, so it is safe to use pull_request_target. + branches: + - "4.0" + types: + - opened + - edited + - reopened + - synchronize + - ready_for_review + +# Cancel in-progress runs of this workflow if a new run is triggered. +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: {} + +jobs: + main: + name: Validate commit messages + # Prevent forks from running a stale/vulnerable copy of this workflow with Actions enabled + if: github.repository == 'microsoft/azurelinux' + runs-on: ubuntu-latest + permissions: + pull-requests: write # Needed to post comments on PR + steps: + - uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0 + id: validate_commits + with: + script: | + // Conventional Commit types documented in CONTRIBUTING.md. + const types = [ + 'feat', 'fix', 'docs', 'style', 'refactor', + 'perf', 'test', 'build', 'ci', 'chore', 'revert', + ]; + // (): + const headerRegex = new RegExp( + '^(' + types.join('|') + ')' + // type + '(\\([^)\\r\\n]+\\))?' + // optional (scope) + '!?' + // optional breaking-change marker + ': .+' // ': ' followed by a non-empty summary + ); + + const pr = context.payload.pull_request; + const commits = await github.paginate( + github.rest.pulls.listCommits, + { + owner: context.repo.owner, + repo: context.repo.repo, + pull_number: pr.number, + per_page: 100, + } + ); + + // pulls.listCommits is hard-capped at 250 commits even with + // pagination. Fail closed if we did not receive the full set the PR + // reports, so a large PR cannot pass by validating only a prefix. + const expected = pr.commits; + if (typeof expected !== 'number' || commits.length !== expected) { + const message = + `Unable to validate all commits: received ${commits.length} ` + + `of ${expected} reported by the pull request. The commit-message ` + + `check cannot guarantee coverage of every commit; please split ` + + `this pull request.`; + core.setOutput('error_message', message); + core.setFailed(message); + return; + } + + // Encode an untrusted commit subject at the rendering boundary: keep + // a conservative allowlist verbatim and emit every other character + // (including Markdown link/image syntax, HTML, mentions, backslashes, + // and Unicode format characters) as an HTML numeric entity. Wrapped + // in a element, the result is inert text in the bot comment. + const encodeSubject = (text) => { + const firstLine = String(text || '').split('\n')[0].slice(0, 200); + let out = ''; + for (const ch of firstLine) { + out += /[A-Za-z0-9 _.\-/:]/.test(ch) + ? ch + : `&#${ch.codePointAt(0)};`; + } + return out; + }; + + const invalid = []; + for (const c of commits) { + const shortSha = c.sha.substring(0, 8); + const subject = String(c.commit.message || '').split('\n')[0]; + if (!headerRegex.test(subject)) { + invalid.push({ sha: shortSha, subject }); + } + } + + if (invalid.length === 0) { + core.setOutput('error_message', ''); + core.info(`All ${commits.length} commit message(s) are valid.`); + return; + } + + // Comment body: HTML-encoded subjects inside elements. + const list = invalid + .map((c) => `- \`${c.sha}\` ${encodeSubject(c.subject)}`) + .join('\n'); + const commentMessage = + `The following commit(s) do not follow the Conventional Commits ` + + `header format:\n\n${list}`; + core.setOutput('error_message', commentMessage); + + // Failure annotation/log: SHAs only, so no untrusted subject text is + // echoed into plain-text log output. + core.setFailed( + `The following commit(s) do not follow the Conventional Commits ` + + `header format: ${invalid.map((c) => c.sha).join(', ')}. ` + + `See the pull request comment for details.` + ); + + - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 + # When the previous step fails, the workflow would stop. By adding this + # condition you can continue the execution with the populated error message. + if: always() && (steps.validate_commits.outputs.error_message != '') + with: + header: commit-message-lint-error + message: | + Hello, and thank you for opening this pull request! 👋🏼 We appreciate the contribution. + + Because this repository uses **rebase-merge**, every commit you push becomes part of the permanent `4.0` history. We require each commit message header to follow the [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/), as described in [`CONTRIBUTING.md`](https://github.com/microsoft/azurelinux/blob/4.0/CONTRIBUTING.md#conventional-commits). PR titles do **not** need to follow this format. + + A valid header looks like: + + ``` + feat(component): add capability + fix(kernel)!: change incompatible behavior + ``` + + Use one of the standard types: `feat`, `fix`, `docs`, `style`, `refactor`, `perf`, `test`, `build`, `ci`, `chore`, `revert`. The scope in parentheses and the `!` breaking-change marker are optional. + + Please fix the offending commit(s) below by amending or rebasing: + + - To fix the most recent commit: `git commit --amend`, then `git push --force-with-lease`. + - To fix earlier commits (including `fixup!` / "address review feedback" commits): `git rebase -i`, reword the offending commits, then `git push --force-with-lease`. + + Details: + + ${{ steps.validate_commits.outputs.error_message }} + + # Delete the previous comment once every commit message is valid. + - if: steps.validate_commits.outputs.error_message == '' + uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 + with: + header: commit-message-lint-error + delete: true diff --git a/.github/workflows/check-pr-title.yml b/.github/workflows/check-pr-title.yml deleted file mode 100644 index af58afd57cf..00000000000 --- a/.github/workflows/check-pr-title.yml +++ /dev/null @@ -1,70 +0,0 @@ -# -# NOTE: This workflow was directly based on the sample -# (reference: https://github.com/amannn/action-semantic-pull-request) -# -# Workflows that run on 'pull_request_target' trigger need to be carefully -# reviewed since they run in the context of the PR target and consume unvalidated -# input controlled by a PR submitter. We've reviewed this workflow and -# allow-listed it via the 'zizmor' comment below. -# - -name: "Check PR Title" - -on: - pull_request_target: # zizmor: ignore[dangerous-triggers] - # Only run on PRs targeting 4.0. pull_request_target always uses the workflow - # from the default branch. This PR does not require any untrusted scripts from - # the PR branch, so it is safe to use pull_request_target. - branches: - - "4.0" - types: - - opened - - edited - - reopened - -# Cancel in-progress runs of this workflow if a new run is triggered. -concurrency: - group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} - cancel-in-progress: true - -permissions: {} - -jobs: - main: - name: Validate PR title - # Prevent forks from running a stale/vulnerable copy of this workflow with Actions enabled - if: github.repository == 'microsoft/azurelinux' - runs-on: ubuntu-latest - permissions: - pull-requests: write # Needed to post comments on PR - steps: - - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1 - id: lint_pr_title - env: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - - - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 - # When the previous step fails, the workflow would stop. By adding this - # condition you can continue the execution with the populated error message. - if: always() && (steps.lint_pr_title.outputs.error_message != null) - with: - header: pr-title-lint-error - message: | - Hello, and thank you for opening this pull request! 👋🏼 We appreciate the contribution. - - We require pull request titles to follow the [Conventional Commits specification](https://www.conventionalcommits.org/en/v1.0.0/) and it looks like your proposed title needs to be adjusted. - - Commits in this repo will typically be prefixed with `fix:`, `feat:`, `docs:`, `chore:`, `refactor:`, `test:`, or `ci:` to indicate the type of change being proposed. The linked specification has more details. - - Details: - - ``` - ${{ steps.lint_pr_title.outputs.error_message }} - ``` - - # Delete a previous comment when the issue has been resolved - - if: steps.lint_pr_title.outputs.error_message == null - uses: marocchino/sticky-pull-request-comment@5770ad5eb8f42dd2c4f34da00c94c5381e49af88 # v3.0.5 - with: - header: pr-title-lint-error - delete: true diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index a16ac719e66..befefabb069 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -121,7 +121,12 @@ PR. Concretely: ### Validating your commits -Before pushing, validate each commit, not just the tip of the branch. CI enforces that +Before pushing, validate each commit, not just the tip of the branch. CI validates the +Conventional Commit header of **every** commit in the PR (not the PR title), so make +sure each commit's summary line follows the format above. PR titles only need to be +descriptive — they are not required to follow Conventional Commits. Clean up any invalid +or `fixup!` commits (see [Responding to review feedback](#responding-to-review-feedback)) +before your PR is approved. CI also enforces that rendered specs match the committed state, so re-render any components you touched. For changes that affect RPM output, build and smoke-test the result. Pure documentation or metadata changes don't require a rebuild. See the [`README.md`](README.md) for