ci: Add GH workflow to validate PR titles follow Conventional Commits. #40
Conversation
WalkthroughThe pull request introduces modifications to the pull request template and adds a new GitHub Actions workflow. The template now emphasizes the need for pull request titles to conform to the Conventional Commits specification, including an example for clarity. Additionally, the new workflow, Changes
Suggested reviewers
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media? 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 0
🧹 Outside diff range and nitpick comments (1)
.github/workflows/pr-title-checks.yaml (1)
16-26: Consider adding custom validation configurationThe basic setup is good, but consider enhancing it with custom configuration options provided by the action:
- Custom error messages for better user experience
- Specific commit type scopes for your project
- Custom commit types if needed
Here's a suggested enhancement:
- uses: "amannn/action-semantic-pull-request@v5" env: GITHUB_TOKEN: "${{secrets.GITHUB_TOKEN}}" + with: + # Add custom types beyond conventional commit types + types: | + feat + fix + docs + style + refactor + perf + test + build + ci + chore + revert + # Custom error message + errorComment: | + Please ensure your pull request title follows the Conventional Commits specification: + https://www.conventionalcommits.org/ + + Example: feat(parser): add ability to parse arrays
📜 Review details
Configuration used: CodeRabbit UI
Review profile: CHILL
📒 Files selected for processing (2)
.github/PULL_REQUEST_TEMPLATE.md(1 hunks).github/workflows/pr-title-checks.yaml(1 hunks)
✅ Files skipped from review due to trivial changes (1)
- .github/PULL_REQUEST_TEMPLATE.md
🔇 Additional comments (2)
.github/workflows/pr-title-checks.yaml (2)
8-15: LGTM! Well-configured permissions and concurrency settings
The configuration follows security best practices:
- Minimal permissions following principle of least privilege
- Efficient concurrency handling to prevent redundant runs
3-6: Verify security implications of using pull_request_target
The use of pull_request_target is acceptable here since the workflow only reads PR metadata and doesn't check out or execute PR code. However, be cautious about future modifications to this workflow.
Run this check to verify no risky actions are present:
✅ Verification successful
Use of pull_request_target is secure in this workflow
The workflow is properly configured and secure:
- No checkout action is present
- Only uses
amannn/action-semantic-pull-requestwhich reads PR metadata - Minimal permissions are set (
permissions: {}with onlypull-requests: read) - No script execution or PR code access
🏁 Scripts executed
The following scripts were executed for the analysis:
Script:
#!/bin/bash
# Description: Check for potentially risky actions in the workflow
# Look for checkout actions or script execution
rg -i "uses:\s+actions/checkout@|run:" .github/workflows/pr-title-checks.yaml
Length of output: 79
Script:
#!/bin/bash
# Let's view the entire workflow file content to verify all actions used
cat .github/workflows/pr-title-checks.yaml
Length of output: 598
junhaoliao
changed the title
|
Sorry, can we update it to follow https://github.com/y-scope/clp-loglib-py/blob/main/.github/workflows/pr-title-checks.yaml? That's the latest version of this that we should propagate across all repos. |
This PR is a copy of log viewer PR
Convention Commits is a specification for writing commit messages (or in our case, PR titles) that makes it easy to see at a glance what change the commit makes which in turn makes it easier to generate release notes.
Validation performed
success: https://github.com/davemarco/clp-ffi-js-fork/actions/runs/12279470331/job/34263582133?pr=5
failed: https://github.com/davemarco/clp-ffi-js-fork/actions/runs/12279398120/job/34263345957?pr=4
Summary by CodeRabbit
New Features
Documentation