From 26f2e648d264a9cf17be1bb08bcee6d24e17d4f3 Mon Sep 17 00:00:00 2001 From: Fabian Engelniederhammer Date: Thu, 8 Jan 2026 10:35:23 +0100 Subject: [PATCH 1/6] lint PR title instead of commits --- .github/workflows/commitlint.yml | 5 +++-- CONTRIBUTING.md | 4 +++- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index 54d7437f9..7ffed692a 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -29,5 +29,6 @@ jobs: - name: Install npm packages run: npm ci - - name: Validate PR commits with commitlint - run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --verbose + - name: Lint PR title + run: | + echo "${{ github.event.pull_request.title }}" | npx commitlint --verbose diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index c3bbffc9a..8c60f41b3 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -4,7 +4,9 @@ Contributions are very welcome! Just fork the repository, develop in a branch an ## Commit Messages -We follow [conventional commits](https://www.conventionalcommits.org) when writing commit messages. +Commits on the `main` branch should follow [conventional commits](https://www.conventionalcommits.org). +Since we squash-merge pull requests, the PR title should also follow conventional commits +(bcause it will become the commit message of the squashed commit). The messages themselves should help future developers understand **why** changes were made. ## Code Style From 17cc7f6edbbf78061048eaed94cd7c4596691b51 Mon Sep 17 00:00:00 2001 From: Fabian Engelniederhammer Date: Thu, 8 Jan 2026 10:36:38 +0100 Subject: [PATCH 2/6] remove obsolete scripts --- package.json | 4 ---- 1 file changed, 4 deletions(-) diff --git a/package.json b/package.json index 4b7274c65..007e273f1 100644 --- a/package.json +++ b/package.json @@ -8,9 +8,5 @@ "@commitlint/cli": "^19.4.0", "@commitlint/config-conventional": "^19.2.2", "@commitlint/types": "^19.0.3" - }, - "scripts": { - "commitlint:last-commit": "commitlint --from=HEAD~1 --verbose", - "commitlint:merge-base": "commitlint --from=$(git merge-base HEAD main) --verbose" } } From 6b51845136812610746c907729911b4c06f898a3 Mon Sep 17 00:00:00 2001 From: Fabian Engelniederhammer Date: Thu, 8 Jan 2026 10:39:24 +0100 Subject: [PATCH 3/6] also on "edited" --- .github/workflows/commitlint.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index 7ffed692a..13c64a389 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -4,6 +4,7 @@ on: pull_request: types: - opened + - edited - reopened - synchronize - ready_for_review From 5039e96d2d4d0949c5465f5c1426ede55784a52c Mon Sep 17 00:00:00 2001 From: Fabian Engelniederhammer Date: Thu, 8 Jan 2026 10:42:18 +0100 Subject: [PATCH 4/6] typo --- CONTRIBUTING.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 8c60f41b3..bda464925 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -6,7 +6,7 @@ Contributions are very welcome! Just fork the repository, develop in a branch an Commits on the `main` branch should follow [conventional commits](https://www.conventionalcommits.org). Since we squash-merge pull requests, the PR title should also follow conventional commits -(bcause it will become the commit message of the squashed commit). +(because it will become the commit message of the squashed commit). The messages themselves should help future developers understand **why** changes were made. ## Code Style From d45f202927a4b808107f768702ebcb99f00ab440 Mon Sep 17 00:00:00 2001 From: Fabian Engelniederhammer Date: Thu, 8 Jan 2026 10:56:11 +0100 Subject: [PATCH 5/6] prevent command line injection --- .github/workflows/commitlint.yml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index 13c64a389..832043479 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -32,4 +32,7 @@ jobs: - name: Lint PR title run: | - echo "${{ github.event.pull_request.title }}" | npx commitlint --verbose + cat << 'EOF' > pr_title.txt + ${{ github.event.pull_request.title }} + EOF + npx commitlint --verbose < pr_title.txt \ No newline at end of file From 4b2a2b43338bcbfc47089b918d7d504dcf5a256f Mon Sep 17 00:00:00 2001 From: Fabian Engelniederhammer Date: Thu, 8 Jan 2026 11:01:00 +0100 Subject: [PATCH 6/6] prevent command line injection --- .github/workflows/commitlint.yml | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) diff --git a/.github/workflows/commitlint.yml b/.github/workflows/commitlint.yml index 832043479..c3579d2a6 100644 --- a/.github/workflows/commitlint.yml +++ b/.github/workflows/commitlint.yml @@ -31,8 +31,6 @@ jobs: run: npm ci - name: Lint PR title - run: | - cat << 'EOF' > pr_title.txt - ${{ github.event.pull_request.title }} - EOF - npx commitlint --verbose < pr_title.txt \ No newline at end of file + env: + PR_TITLE: ${{ github.event.pull_request.title }} + run: echo "$PR_TITLE" | npx commitlint --verbose \ No newline at end of file