tools: lint PR commit messages without approval - #65875
Open
panva wants to merge 1 commit into
Open
Conversation
Use pull_request_target to run commit message linting without fork workflow approval. Fetch the first commit through the API and pass its message to a pinned validator as JSON on stdin. Capture validator output and report failures through escaped annotations, using only read access to pull requests. Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Collaborator
|
Review requested:
|
nodejs-github-bot
added
the
meta
MikeMcC399
approved these changes
Sep 7, 2026
MikeMcC399
left a comment
MikeMcC399
left a comment
Contributor
There was a problem hiding this comment.
RSLGTM!
I agree very much with the goal of linting the commit message(s) without approval. The new comment text to first-time contributors already reminds about the need for a Signed-off-by trailer, and this PR means they don't have to wait to get checked.
jasnell
approved these changes
Sep 7, 2026
panva
added
the
author ready
aduh95
reviewed
Sep 7, 2026
Comment on lines
+28
to
+52
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | ||
| with: | ||
| script: | | ||
| const { data: [commit] } = await github.rest.pulls.listCommits({ | ||
| ...context.repo, | ||
| pull_number: context.issue.number, | ||
| per_page: 1, | ||
| }); | ||
| if (!commit) { | ||
| throw new Error('No commits found in pull request'); | ||
| } | ||
| const { exitCode, stdout, stderr } = await exec.getExecOutput('npx', [ | ||
| '-q', '--yes', '--ignore-scripts', 'core-validate-commit@6.0.0', | ||
| '--no-validate-metadata', '--tap', '-', | ||
| ], { | ||
| cwd: process.env.RUNNER_TEMP, | ||
| input: Buffer.from(JSON.stringify([{ id: commit.sha, message: commit.commit.message }])), | ||
| silent: true, | ||
| ignoreReturnCode: true, | ||
| }); | ||
| if (exitCode !== 0) { | ||
| core.setFailed(stdout + stderr || 'Commit message validation failed'); | ||
| } else { | ||
| core.info('First commit message passes validation'); | ||
| } |
Contributor
There was a problem hiding this comment.
I think this would work and be more maintainable
Suggested change
| uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0 | |
| with: | |
| script: | | |
| const { data: [commit] } = await github.rest.pulls.listCommits({ | |
| ...context.repo, | |
| pull_number: context.issue.number, | |
| per_page: 1, | |
| }); | |
| if (!commit) { | |
| throw new Error('No commits found in pull request'); | |
| } | |
| const { exitCode, stdout, stderr } = await exec.getExecOutput('npx', [ | |
| '-q', '--yes', '--ignore-scripts', 'core-validate-commit@6.0.0', | |
| '--no-validate-metadata', '--tap', '-', | |
| ], { | |
| cwd: process.env.RUNNER_TEMP, | |
| input: Buffer.from(JSON.stringify([{ id: commit.sha, message: commit.commit.message }])), | |
| silent: true, | |
| ignoreReturnCode: true, | |
| }); | |
| if (exitCode !== 0) { | |
| core.setFailed(stdout + stderr || 'Commit message validation failed'); | |
| } else { | |
| core.info('First commit message passes validation'); | |
| } | |
| run: echo "$COMMITS" | npx -q core-validate-commit - | |
| env: | |
| COMMITS: ${{ toJSON([github.event.commits[0]]) }} |
Member
Author
There was a problem hiding this comment.
Wouldn't work. github.event.commits is an integer count for pull_request_target, not the individual commits, and array index literals don't work in expressions either. I also wanted to avoid streaming linter output to avoid workflow-command injection since we're on pull_request_target.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This lets first time contributor PRs know their commit message is invalid without a collaborator having to step in and approve the GHA workflow runs and without checking out the fork code.
Use pull_request_target to run commit message linting without fork workflow approval. Fetch the first commit through the API and pass its message to a pinned validator as JSON on stdin.
Capture validator output and report failures through escaped annotations, using only read access to pull requests.