Repository navigation
feat: detect Amp, OpenHands, Factory Droid and Jules signatures #271
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Commit Check | |
| permissions: | |
| contents: read | |
| on: | |
| # Pull requests only, deliberately. | |
| # | |
| # A push to main carries the squashed commit, whose subject is the pull | |
| # request title with " (#N)" appended by GitHub. Checking there re-runs work | |
| # that already passed, against a subject the author never wrote and cannot | |
| # shorten — which is how #530 passed review at 75 characters and then failed | |
| # on main at 82, against a limit of 80. | |
| # | |
| # No `paths:` filter either. A subject, a branch name or an author address is | |
| # wrong regardless of which files the change touches, and the filter on | |
| # main.yml is why nothing ran on #530 at all: it changed only assets/. | |
| # | |
| # `edited` matters: a squash merge turns the title into the commit subject, | |
| # so retitling a pull request changes what will be committed. | |
| pull_request: | |
| types: [opened, synchronize, reopened, edited] | |
| jobs: | |
| commit-check: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| fetch-depth: 0 # full history, so branch and rebase checks can resolve | |
| # Nothing after checkout needs authenticated git. | |
| persist-credentials: false | |
| - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 | |
| with: | |
| python-version: '3.x' | |
| # From source, not from PyPI, and not through commit-check-action. | |
| # | |
| # The action installs a released commit-check, so running it here would | |
| # check this pull request with the version before it — which is how #540 | |
| # had its own title rejected by the bug it was fixing. A self-test that | |
| # cannot see the change under test is not a self-test. | |
| - name: Install commit-check from this checkout | |
| run: python -m pip install . | |
| - name: Check the title, the branch and the author | |
| env: | |
| # Via the environment, never interpolated into the script: a pull | |
| # request title is attacker-controlled text. | |
| PR_TITLE: ${{ github.event.pull_request.title }} | |
| run: | | |
| # The title, because a squash merge commits it as the subject. The | |
| # branch's own commit messages are not checked: this repository | |
| # squashes, so they never reach main. A local hook is where that | |
| # feedback belongs — it arrives while the message is being written, | |
| # not a CI round trip later. | |
| # | |
| # Not a bare `commit-check --message` either. That reads HEAD, which | |
| # on a pull_request checkout is the synthetic merge commit, which the | |
| # engine skips — so it would report a pass having read nothing. | |
| printf '%s\n' "$PR_TITLE" | commit-check --message --no-banner | |
| # stdin closed: left open, commit-check waits to read a message even | |
| # for checks that do not take one, and the step hangs rather than | |
| # fails. --branch resolves GITHUB_HEAD_REF on a detached checkout. | |
| commit-check --branch --author-name --author-email --no-banner < /dev/null |