From a1890d425da2a444a84649cdd5a18e9ae7a51b35 Mon Sep 17 00:00:00 2001 From: Clyde Kallahan Date: Fri, 6 Nov 2026 14:58:05 -0500 Subject: [PATCH 1/2] ci: apply the repo standard (EN-214) --- .github/workflows/commits.yml | 23 ------------- .github/workflows/conventional-commits.yml | 40 ++++++++++++++++++++++ .github/workflows/pr-title.yml | 12 +++++-- README.md | 4 +-- 4 files changed, 51 insertions(+), 28 deletions(-) delete mode 100644 .github/workflows/commits.yml create mode 100644 .github/workflows/conventional-commits.yml diff --git a/.github/workflows/commits.yml b/.github/workflows/commits.yml deleted file mode 100644 index 4391314..0000000 --- a/.github/workflows/commits.yml +++ /dev/null @@ -1,23 +0,0 @@ -name: commits - -# release-please builds versions and the changelog from commit subjects, so -# every commit must be a conventional commit. -on: [push, pull_request] - -permissions: - contents: read - -jobs: - build: - name: conventional - runs-on: ubuntu-latest - steps: - - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 - - - uses: webiny/action-conventional-commits@8bc41ff4e7d423d56fa4905f6ff79209a78776c7 # v1.3.0 - with: - GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} - # Same types as pr-title.yml. The action's default also allows wip and - # merge, which release-please ignores. Git's own "Merge ..." and - # "Revert ..." messages are always allowed. - allowed-commit-types: "feat,fix,docs,style,refactor,test,build,perf,ci,chore,revert" diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml new file mode 100644 index 0000000..1a0e997 --- /dev/null +++ b/.github/workflows/conventional-commits.yml @@ -0,0 +1,40 @@ +# Every commit on a branch must be a conventional commit: release-please builds +# versions and the changelog from commit subjects. Merge commits are skipped. +# Same check as the other UnlockEd repos (see docs/repo-standard.md in +# unlocked-core). +name: conventional commits + +on: + pull_request: + +permissions: + contents: read + +jobs: + commits: + name: conventional commits + runs-on: ubuntu-latest + steps: + - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + fetch-depth: 0 + + - name: Check commit subjects + env: + BASE: ${{ github.event.pull_request.base.sha }} + HEAD: ${{ github.event.pull_request.head.sha }} + run: | + set -euo pipefail + pattern='^(feat|fix|chore|docs|refactor|test|ci|build|perf|revert|style)(\([a-z0-9._/-]+\))?!?: .+' + bad=0 + while IFS= read -r subject; do + if ! printf '%s' "$subject" | grep -Eq "$pattern"; then + echo "::error::not a conventional commit: $subject" + if [[ $subject == 'Revert "'* ]]; then + inner=${subject#Revert \"} + echo "::error::reword it to: revert: ${inner%\"}" + fi + bad=1 + fi + done < <(git log --no-merges --format=%s "$BASE..$HEAD") + exit $bad diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 6775f1a..7396d2e 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -1,7 +1,9 @@ -name: PR title - # Squash and merge lands a multi-commit PR on main under its title, so the -# title must be a conventional commit too (commits.yml checks the commits). +# title must be a conventional commit too. The "conventional commits" job in +# conventional-commits.yml checks the commits; keep the two patterns in sync. Same check as +# the other UnlockEd repos (see docs/repo-standard.md in unlocked-core). +name: pr title + on: pull_request: types: [opened, edited, reopened, synchronize] @@ -22,5 +24,9 @@ jobs: pattern='^(feat|fix|chore|docs|refactor|test|ci|build|perf|revert|style)(\([a-z0-9._/-]+\))?!?: .+' if ! printf '%s' "$TITLE" | grep -Eq "$pattern"; then echo "::error::PR title is not a conventional commit: $TITLE" + if [[ $TITLE == 'Revert "'* ]]; then + inner=${TITLE#Revert \"} + echo "::error::rename the PR to: revert: ${inner%\"}" + fi exit 1 fi diff --git a/README.md b/README.md index 7d2582f..c6a375c 100644 --- a/README.md +++ b/README.md @@ -58,7 +58,7 @@ Settings, all from the environment: ### Commit types -The `conventional` and `pr title` checks allow these types, and nothing else: +The `conventional commits` and `pr title` checks allow these types, and nothing else: | Type | In the changelog? | Version bump | |---|---|---| @@ -200,7 +200,7 @@ Replace `` with the new repo's name, such as `unlocked-open-content`. ``` 3. **Branch protection on `main`:** copy the template's `protect-main` ruleset (PRs with one approval, and the `vet and test`, `golangci-lint`, - `govulncheck`, `conventional` and `pr title` checks). One line, so it works + `govulncheck`, `conventional commits` and `pr title` checks). One line, so it works in bash and fish: ```sh gh api repos/UnlockedLabs/unlocked-product-template/rulesets/$(gh api repos/UnlockedLabs/unlocked-product-template/rulesets --jq '.[] | select(.name=="protect-main") | .id') --jq '{name, target, enforcement, conditions, rules, bypass_actors}' | gh api -X POST repos/UnlockedLabs//rulesets --input - From 0acb0618aaaae4d56eedec33ee63d8a7ba7ad469 Mon Sep 17 00:00:00 2001 From: Clyde Kallahan Date: Fri, 6 Nov 2026 23:42:54 -0500 Subject: [PATCH 2/2] ci: re-run the commit check on edited and fail on an unreadable range (EN-214) --- .github/PULL_REQUEST_TEMPLATE.md | 2 +- .github/workflows/conventional-commits.yml | 3 +++ 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md index 3b2ced4..ecc250a 100644 --- a/.github/PULL_REQUEST_TEMPLATE.md +++ b/.github/PULL_REQUEST_TEMPLATE.md @@ -19,7 +19,7 @@ Please provide a brief description of the changes included in this PR. ## Release - **Changelog type**: `feat` (minor bump), `fix`, `perf` or `revert` (patch bump), or none (`chore`, `docs`, `style`, `refactor`, `test`, `build`, `ci`). See "Commit types" in the README. -- **Breaking change?**: yes / no. If yes, add `!` to the title (`feat!:`) and list what sites or other repos must change. +- **Breaking change?**: yes / no. If yes, add `!` to the title (`feat!:`). For a merge or rebase merge, also add `!` to a breaking commit subject. List what sites or other repos must change. ## Additional context diff --git a/.github/workflows/conventional-commits.yml b/.github/workflows/conventional-commits.yml index 1a0e997..0c78aa5 100644 --- a/.github/workflows/conventional-commits.yml +++ b/.github/workflows/conventional-commits.yml @@ -6,6 +6,7 @@ name: conventional commits on: pull_request: + types: [opened, synchronize, reopened, edited] permissions: contents: read @@ -25,6 +26,8 @@ jobs: HEAD: ${{ github.event.pull_request.head.sha }} run: | set -euo pipefail + # the loop reads git log through process substitution, so a bad range would pass silently + git rev-list "$BASE..$HEAD" > /dev/null pattern='^(feat|fix|chore|docs|refactor|test|ci|build|perf|revert|style)(\([a-z0-9._/-]+\))?!?: .+' bad=0 while IFS= read -r subject; do