ci: standardize commit messages by ted-palmer · Pull Request #1119 · relayprotocol/relay-kit

ted-palmer · 2026-09-01T14:50:48Z

No description provided.

vercel · 2026-09-01T14:50:54Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
relay-sdk-demo	Ready	Preview	Sep 2, 2026 7:05pm UTC

github-actions · 2026-09-01T14:51:08Z

Claude finished @ted-palmer's task in 33s —— View job

📝 Docs Drift Check — No docs impact

This PR does not touch surfaces that require a relayprotocol/relay-docs update.

github-actions · 2026-09-01T14:51:11Z

Claude finished @ted-palmer's task in 45s —— View job

Code Review — PR #1119

Gather context
Review changed files
Post review

Code Review — 1 issue found

WARNING Architecture: Duplicate PR-title check across two workflows
.github/workflows/pr-title.yml:1 and .github/workflows/pull-request.yml:50 — this PR adds a brand-new standalone PR Title workflow and adds an identical pr-title job to the existing Pull Request workflow. Both trigger on the same events (opened, edited, synchronize), check out the repo with the same action, and run the exact same command (node scripts/check-commit-message.mjs --message "$PR_TITLE"). The result is two redundant status checks running the identical validation on every PR — wasted CI minutes and two near-duplicate "PR title format" checks in the merge UI. Keep only one: either the dedicated pr-title.yml (cleaner separation, and it doesn't need the Node/pnpm/build setup) or the job inside pull-request.yml, but not both.

Everything else looks solid:

scripts/check-commit-message.mjs — arg parsing (--message form), the HEADER_RE regex, and the EXEMPT bypass list are all correct; empty/undefined titles fall through to the error path and exit 1 as intended.
AGENTS.md — documentation update matches the enforced format.
The regex correctly requires a non-empty subject (\S.*) after type(scope)!: .

Reviewed 4 files, 97 lines added. Checked for correctness, security, error handling, and repo guidelines compliance.

greptile-apps · 2026-09-01T14:58:46Z

Greptile Summary

This change adds pull-request title validation and improves SDK transaction completion when a WebSocket confirms success before a late RPC receipt error. The earlier concern that pull-request edits rerun the full build and test suite is disproved: the full CI workflow listens only for opened and synchronized pull requests. One issue remains: malformed Revert titles can bypass the new title convention.

Confidence Score: 4/5

The pull request is not ready to merge because the commit-title validator accepts malformed Revert titles.

The remaining issue lets arbitrary text bypass the repository's intended squash-merge title convention.

Files Needing Attention: scripts/check-commit-message.mjs

T-Rex Logs

What T-Rex did

Reproduced the focused revert-title validator proof for the posted P1 finding using the reproduction script and captured its observed output.
Validated that PR edits do not trigger the full build by running a structural check on .github/workflows/pull-request.yml and confirming that edits are not listed as a trigger.
Compared WebSocket orchestration between the parent revision and the live code; the live code completed WebSocket success even after a late receipt error, while failure and refund remained rejected.
Demonstrated a validator repro script highlighting that malformed text can bypass PR-title validation by starting with Revert and ending with a quote.
Confirmed that the edited-trigger structural check ran without repository changes; the script executed and produced an observed output, with only requested proof artifacts created.

_{Ran code and verified through T-Rex}

Comments Outside Diff (2)

General comment

Greedy Revert exemption accepts malformed PR titles
- Bug
  - Revert "feat: restore behavior" arbitrary suffix" and Revert "fix: restore behavior" and "embedded quote" both exit 0, while the equivalent ordinary invalid title exits 1.
- Cause
  - The exemption on scripts/check-commit-message.mjs:21, /^Revert ".+"$/, uses greedy .+ between only the first opening and final closing quote, allowing arbitrary text and additional quotes inside.
- Fix
  - Constrain the quoted payload so it cannot contain quotes or validate the expected Git revert-title structure, for example /^Revert "[^"]+"$/ if any single quoted title remains acceptable.
_{Ran code and verified through T-Rex}
General comment

Pull-request edits do not trigger full CI
- Bug
  - The PR workflow restricts pull_request.types to opened and synchronize, so editing a pull request does not start either the build/lint/test job or the changeset-quality job.
- Cause
  - .github/workflows/pull-request.yml omits edited from the on.pull_request.types list.
- Fix
  - Add edited to .github/workflows/pull-request.yml under on.pull_request.types so the existing full-CI jobs run after PR edit events.
_{Ran code and verified through T-Rex}

_{Reviews (5): Last reviewed commit: "ci: standardize commit messages" | Re-trigger Greptile}

github-actions · 2026-09-01T15:24:04Z

Claude finished @ted-palmer's task in 1m 6s —— View job

Code Review — PR #1119

Gather context (diff, commit history, workflow files)
Review changed files
Post review

Code Review — No issues found.

Reviewed 3 files, 84 lines changed. Checked for correctness, security, error handling, and repo guidelines compliance.

Notes on the current state (the earlier bot findings have been addressed in this revision):

scripts/check-commit-message.mjs — Arg parsing (--message form and bare positional), the HEADER_RE regex (type(scope)!: <non-empty subject>), and the exit paths are correct. Missing/empty titles fall through to the error branch and exit 1 as intended.
EXEMPT list is now narrow — /^Revert ".+"/, /^Version Packages/, /^Release the: /. The previously-flagged broad /^Merge / and /^Revert / exemptions are gone, so arbitrary Merge … titles no longer bypass validation; only GitHub's standard Revert "…" auto-titles and release PRs are exempt.
No duplicate title check — .github/workflows/pull-request.yml was not modified in this PR (no edited trigger, no in-workflow pr-title job). Validation lives solely in the new dedicated pr-title.yml, so the earlier duplication/edited-fanout concerns don't apply to this diff.
pr-title.yml — Passes the title via the PR_TITLE env var rather than inline interpolation into run:, which avoids shell injection from PR titles. Pinned action SHA and least-privilege contents: read are correct.
AGENTS.md — Documentation matches the enforced format and type list.

github-actions · 2026-09-01T15:24:09Z

Claude finished @ted-palmer's task in 1m 42s —— View job

Review — PR #1119 (current state)

I re-reviewed the pushed code against the earlier bot feedback. The latest commit resolves all three findings — the versions the bots reviewed no longer match what's on the branch.

Gather context
Re-check the flagged issues against current code
Post review

✅ Prior findings — all addressed

1. Duplicate PR-title check across two workflows (code-review WARNING)
Resolved. .github/workflows/pull-request.yml now contains only the test and changesets jobs — there is no in-workflow pr-title job. Title validation lives solely in the dedicated pr-title.yml. Single check, single status.

2. edited reruns full CI + duplicate title validation (Greptile P2)
Resolved. pull-request.yml triggers only on opened + synchronize (pull-request.yml:5-7), so PR title/body edits no longer reinstall deps and rerun build/lint/tests. Only pr-title.yml listens on edited, and it runs just the lightweight title check (no Node/pnpm/build setup).

3. Broad Merge / Revert exemptions bypass validation (Greptile P2)
Resolved. EXEMPT is now narrow (check-commit-message.mjs:21):

const EXEMPT = [/^Revert ".+"/, /^Version Packages/, /^Release the: /]

There is no bare /^Merge / exemption anymore, and /^Revert ".+"/ only matches git's auto-generated revert format (Revert "type(scope): subject") — a casual Revert something now correctly fails. Version Packages (changesets release PR) and Release the: are intentional automation titles.

Correctness spot-check (`check-commit-message.mjs`)

HEADER_RE = ^(type)($scope$)?!?: \S.*$ correctly requires a non-empty subject, so fix: (empty) fails and feat(sdk)!: drop node 18 (breaking) passes.
Arg parsing handles both --message "x" and a bare positional arg; undefined/empty titles fall through to exit(1).
EXEMPT.some(...) || HEADER_RE.test(...) logic is sound now that the exemptions are tightly scoped.

Optional nit (non-blocking)

pr-title.yml also triggers on synchronize (pr-title.yml:8). A PR title can't change on a code push, so this re-runs the title check on every commit push. opened + edited alone would cover every case where the title actually changes. Harmless — the check is cheap — but you could drop synchronize to shave a redundant run. Keeping it is also defensible if you want the check to appear on the very first push for a PR opened as a draft. Your call.

Nothing blocking. LGTM. ✅

github-actions · 2026-09-01T15:34:25Z

Claude finished @ted-palmer's task in 32s —— View job

📝 Docs Drift Check — No docs impact

This PR does not touch surfaces that require a relayprotocol/relay-docs update.

github-actions · 2026-09-01T15:34:27Z

Claude finished @ted-palmer's task in 52s —— View job

Code Review — PR #1119

Gather context (diff, commit history, workflow files)
Review changed files
Post review

Code Review — No issues found.

Reviewed 3 files (pr-title.yml, check-commit-message.mjs, AGENTS.md), 84 lines added. Checked for correctness, security, error handling, and repo guidelines compliance.

The current revision resolves the earlier bot findings:

Revert exemption is now anchored — EXEMPT = [/^Revert ".+"$/, /^Version Packages/, /^Release the: /] (scripts/check-commit-message.mjs:21). The trailing $ fixes the Greptile P1: Revert "fix: valid subject" arbitrary suffix no longer matches (it doesn't end in "), so malformed reverts can't bypass the policy. The exemptions are narrow — only git's auto-generated Revert "…" titles, changesets' Version Packages, and Release the: automation titles.
No duplicate title check — .github/workflows/pull-request.yml is not modified in this PR, so there's no in-workflow pr-title job. Validation lives solely in the dedicated pr-title.yml, giving a single status check.
check-commit-message.mjs is correct — HEADER_RE = ^(type)($[^)]+$)?!?: \S.*$ requires a non-empty subject (fix: fails, feat(sdk)!: drop node 18 passes). Arg parsing handles both --message "x" and a bare positional; missing/empty titles fall through to the error branch and exit 1.
pr-title.yml — passes the title via the PR_TITLE env var instead of interpolating into run: (avoids shell injection from PR titles), pins the checkout action to a SHA, and uses least-privilege contents: read. It also skips dependabot[bot] / github-actions[bot] actors.
AGENTS.md — the documented format and type list match what the script enforces.

Nothing blocking. LGTM ✅
• ted/standardize-commit-messages

github-actions · 2026-09-02T17:30:56Z

Claude finished @ted-palmer's task in 31s —— View job

📝 Docs Drift Check — No docs impact

This PR does not touch surfaces that require a relayprotocol/relay-docs update.

github-actions · 2026-09-02T17:30:57Z

Claude finished @ted-palmer's task in 34s —— View job

Code Review — PR #1119

Gather context (diff, commit history, workflow files)
Review changed files
Post review

Code Review — No issues found.

Reviewed 3 files (.github/workflows/pr-title.yml, scripts/check-commit-message.mjs, AGENTS.md), 84 lines added. Checked for correctness, security, error handling, and repo guidelines compliance.

The current revision resolves all earlier bot findings:

scripts/check-commit-message.mjs — HEADER_RE = ^(type)($[^)]+$)?!?: \S.*$ correctly requires a non-empty subject (fix: fails, feat(sdk)!: drop node 18 passes). Arg parsing handles both --message "x" and a bare positional; missing/empty titles fall through to the error branch and exit(1).
EXEMPT is narrow and anchored — [/^Revert ".+"$/, /^Version Packages/, /^Release the: /]. The trailing $ on the revert pattern fixes the earlier P1: Revert "fix: x" arbitrary suffix no longer matches. The broad /^Merge / and unanchored /^Revert / exemptions are gone, so arbitrary titles can't bypass validation.
pr-title.yml — Passes the title via the PR_TITLE env var rather than interpolating into run: (avoids shell injection from crafted PR titles), pins the checkout action to a SHA, uses least-privilege contents: read, and skips dependabot[bot] / github-actions[bot] actors.
No duplicate title check — .github/workflows/pull-request.yml is not modified in this PR, so validation lives solely in the dedicated pr-title.yml (single status check).
AGENTS.md — the documented format and type list match what the script enforces.

Nothing blocking. LGTM ✅
• ted/standardize-commit-messages

greptile-apps · 2026-09-02T17:37:16Z

+  'test'
+]
+
+const EXEMPT = [/^Revert ".+"$/, /^Version Packages/, /^Release the: /]


Revert exemption accepts arbitrary trailing content

The .+ in the Revert exemption consumes embedded quotes and everything after them. As a result, Revert "fix: valid subject" arbitrary suffix" exits successfully even though it is neither a conventional title nor a well-formed GitHub revert title. Since squash merges use the PR title on main, this bypasses the commit-title convention. Restrict the quoted subject so it cannot contain a quote or trailing content, for example: /^Revert "[^"]+"$/.

Artifacts

Focused validator harness source

Authored Node harness executes canonical and malformed Revert-title cases against the current validator; it documents the exact inputs and confirms both are expected by the current behavior.

Focused harness output accepting both Revert titles

Captured execution of the focused harness from `/home/user/repo`; both the canonical and malformed trailing-suffix titles exit 0, proving the acceptance bypass.

Canonical Revert title validator output

Captured direct validator execution for `Revert "fix: valid subject"`; it exits 0 as the valid baseline.

Malformed Revert title validator output

Captured direct validator execution for `Revert "fix: valid subject" arbitrary suffix"`; it also exits 0, confirming the validator accepts the malformed title.

_{Ran code and verified through T-Rex}

github-actions · 2026-09-02T19:02:17Z

Claude finished @ted-palmer's task in 23s —— View job

📝 Docs Drift Check — No docs impact

This PR does not touch surfaces that require a relayprotocol/relay-docs update.

github-actions · 2026-09-02T19:02:18Z

Claude finished @ted-palmer's task in 59s —— View job

Code Review — PR #1119

Gather context (diff, commit history, workflow file)
Review changed files
Post review

Code Review — 1 issue found (non-blocking)

NOTE Correctness: Revert exemption still accepts trailing content
scripts/check-commit-message.mjs:21 — EXEMPT uses /^Revert ".+"$/. The greedy .+ combined with the $ anchor means a title that merely ends in a quote still passes, e.g. Revert "fix: x" arbitrary suffix" matches (.+ consumes fix: x" arbitrary suffix). GitHub's real auto-generated revert titles are exactly Revert "<original>" with a single trailing quote and no suffix, so tightening to /^Revert "[^"]+"$/ rejects the malformed variant while still accepting genuine reverts. Low impact — the PR author controls their own title, so this is a self-inflicted policy bypass rather than a security issue — but it's a cheap correctness fix. Fix this →

Everything else looks solid:

check-commit-message.mjs — HEADER_RE = ^(type)($[^)]+$)?!?: \S.*$ correctly requires a non-empty subject (fix: fails, feat(sdk)!: drop node 18 passes). Arg parsing handles both --message "x" and a bare positional; missing/empty titles fall through to exit(1).
EXEMPT — narrow and anchored; the broad /^Merge / and unanchored /^Revert / exemptions from earlier revisions are gone.
pr-title.yml — passes the title via the PR_TITLE env var rather than interpolating into run: (avoids shell injection from crafted titles), pins the checkout action to a SHA, uses least-privilege contents: read, and skips dependabot[bot] / github-actions[bot].
No duplicate title check — .github/workflows/pull-request.yml is not modified, so validation lives solely in the dedicated pr-title.yml.
AGENTS.md — documented format and type list match what the script enforces.

Reviewed 3 files, 84 lines changed. Checked for correctness, security, error handling, and repo guidelines compliance.
• ted/standardize-commit-messages

greptile-apps · 2026-09-02T19:11:17Z

+  'test'
+]
+
+const EXEMPT = [/^Revert ".+"$/, /^Version Packages/, /^Release the: /]


Greedy Revert exemption accepts malformed PR titles

/^Revert ".+"$/ accepts arbitrary text and embedded quotes between the opening and final quote. For example, Revert "feat: restore behavior" arbitrary suffix" passes validation even though an equivalent ordinary invalid title is rejected. Constrain the quoted content, for example with /^Revert "[^"]+"$/, so malformed titles cannot bypass the squash-merge convention.

Artifacts

Focused Revert-title validator reproduction script

This script invokes the PR-title validator with valid, ordinary-invalid, and malformed Revert titles, providing the executable reproduction.

Observed Revert-title validator reproduction output

This captured command output shows both malformed Revert titles exiting 0 while the ordinary invalid title exits 1, confirming the bypass.

_{Ran code and verified through T-Rex}

ted-palmer requested a review from pedromcunha September 1, 2026 14:50

vercel Bot deployed to Preview September 1, 2026 14:52 View deployment

greptile-apps Bot reviewed Sep 1, 2026

View reviewed changes

Comment thread scripts/check-commit-message.mjs Outdated

Comment thread .github/workflows/pull-request.yml Outdated

ted-palmer force-pushed the ted/standardize-commit-messages branch from 0c97a88 to 7c89f6c Compare September 1, 2026 15:23

vercel Bot deployed to Preview September 1, 2026 15:25 View deployment

greptile-apps Bot reviewed Sep 1, 2026

View reviewed changes

Comment thread scripts/check-commit-message.mjs Outdated

ted-palmer force-pushed the ted/standardize-commit-messages branch from 7c89f6c to 0cce196 Compare September 1, 2026 15:34

vercel Bot deployed to Preview September 1, 2026 15:36 View deployment

pedromcunha approved these changes Sep 2, 2026

View reviewed changes

pedromcunha self-requested a review September 2, 2026 17:31

pedromcunha approved these changes Sep 2, 2026

View reviewed changes

vercel Bot deployed to Preview September 2, 2026 17:34 View deployment

greptile-apps Bot reviewed Sep 2, 2026

View reviewed changes

ci: standardize commit messages

22621f6

ted-palmer force-pushed the ted/standardize-commit-messages branch from e0b83de to 22621f6 Compare September 2, 2026 19:02

vercel Bot deployed to Preview September 2, 2026 19:05 View deployment

ted-palmer merged commit 2e8ece3 into main Sep 2, 2026
8 checks passed

ted-palmer deleted the ted/standardize-commit-messages branch September 2, 2026 19:06

greptile-apps Bot reviewed Sep 2, 2026

View reviewed changes

Uh oh!

Conversation

ted-palmer commented Sep 1, 2026

Uh oh!

vercel Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review — PR #1119

Uh oh!

greptile-apps Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 4/5

T-Rex Logs

Comments Outside Diff (2)

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review — PR #1119

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review — PR #1119 (current state)

✅ Prior findings — all addressed

Correctness spot-check (check-commit-message.mjs)

Optional nit (non-blocking)

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 1, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review — PR #1119

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review — PR #1119

Uh oh!

greptile-apps Bot Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Sep 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Code Review — PR #1119

Uh oh!

Uh oh!

greptile-apps Bot Sep 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

vercel Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

greptile-apps Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

Correctness spot-check (`check-commit-message.mjs`)

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 1, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading

github-actions Bot commented Sep 2, 2026 •

edited

Loading