commitlint.yml

name: Commitlint

on:
  pull_request:
    types: [opened, edited, synchronize, reopened]

jobs:
  commitlint:
    name: Lint Commit Messages
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v5
        with:
          fetch-depth: 0

      - name: Setup pnpm
        uses: pnpm/action-setup@v4

      - name: Setup Node.js
        uses: actions/setup-node@v6
        with:
          # Node 24 LTS, matching the rest of CI (pnpm 11 floor is Node 22.13).
          # See docs/release-hardening-decisions.md (Decision 3).
          node-version: 24
          cache: 'pnpm'

      - name: Install dependencies
        run: pnpm install --frozen-lockfile

      # Lint only the commits this branch adds, using the merge-base with the
      # live origin/main as the lower bound (not the PR's recorded base SHA,
      # which goes stale as main moves forward). The merge-base is robust even
      # when the branch is behind main: it always resolves to the point where
      # this branch diverged, so the range is exactly the new commits.
      #
      # main MUST be fetched with full history (no --depth). A shallow fetch
      # hides the merge-base, so `git log <main>..HEAD` can no longer exclude
      # shared history and the range balloons to include unrelated historical
      # commits. See docs/release-hardening-plan.md (AC6).
      - name: Resolve lint range
        id: range
        env:
          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail
          git fetch --no-tags origin main:refs/remotes/origin/main
          base=$(git merge-base origin/main "$HEAD_SHA")
          echo "base=${base}" >> "$GITHUB_OUTPUT"
          echo "Linting ${base}..${HEAD_SHA}"

      - name: Lint commits
        run: pnpm exec commitlint --from ${{ steps.range.outputs.base }} --to ${{ github.event.pull_request.head.sha }} --verbose