ci(repo): add commitlint checks#196
Conversation
|
Warning Review limit reached
More reviews will be available in 47 minutes and 53 seconds. Learn how PR review limits work. Your organization has run out of usage credits. Purchase more in the billing tab. ⌛ How to resolve this issue?After more reviews become available, a review can be triggered using the We recommend that you space out your commits to avoid hitting the rate limit. 🚦 How do rate limits work?CodeRabbit enforces hourly rate limits for each developer per organization. Our paid plans include higher PR review limits than trial, open-source, and free plans. In all cases, reviews become available again over time. During sustained high-volume PR review activity, CodeRabbit may temporarily slow when the next review becomes available. Please see our Fair Usage Limits Policy for further information. ℹ️ Review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (2)
📝 WalkthroughWalkthroughThis PR introduces commit message linting via commitlint, dynamically configured with repository-aware scopes. Dependencies are added to the workspace catalog, a configuration file derives valid scopes from the app and package directories, and validation is integrated into both local git hooks and the pull request quality workflow. ChangesCommit Message Linting
Estimated code review effort🎯 2 (Simple) | ⏱️ ~10 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🧹 Nitpick comments (1)
.github/workflows/pr-quality.yaml (1)
21-22: ⚡ Quick winHarden checkout: disable credential persistence and pin the action.
Per the repo's static-analysis policy,
actions/checkoutpersists credentials by default (flaggedartipacked) and@v6is not pinned to a commit SHA (unpinned-uses). Since this is apull_request_targetworkflow, leaking the persisted token is higher risk.🛡️ Suggested change
- name: Checkout repository - uses: actions/checkout@v6 + uses: actions/checkout@<commit-sha> # v6.x.x + with: + persist-credentials: false🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.github/workflows/pr-quality.yaml around lines 21 - 22, The checkout step ("Checkout repository") currently uses "actions/checkout@v6" and leaves credentials persisted; update that step to pin the action to a full commit SHA (replace "`@v6`" with the specific commit SHA for actions/checkout) and add a "with: persist-credentials: false" entry to disable token persistence for the workflow (keep the step name "Checkout repository" and the uses string when locating the change).
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/pr-quality.yaml:
- Around line 27-30: The "Validate PR title" step currently interpolates
github.event.pull_request.title directly into the shell which allows script
injection under pull_request_target; change the step to pass the PR title into a
dedicated environment variable (e.g., PR_TITLE) using env: PR_TITLE: ${{
github.event.pull_request.title }} and then reference that variable in the run
command with proper quoting (e.g., echo "$PR_TITLE" | pnpm commitlint) so the
title is not re-interpreted by the shell; update the step named "Validate PR
title" accordingly.
In `@commitlint.config.mjs`:
- Around line 8-22: getScopes() currently reads "apps" and "packages" with
readdirSync but only adds top-level package names (so packages/core/* derived
scopes like eslint-config, graphql-helpers, etc. are missed) and doesn't filter
entries to directories; update getScopes() to use readdirSync(..., {
withFileTypes: true }) and only include Dirent.isDirectory() entries, and when
encountering a package named "core" (or any package that contains subpackages)
enumerate its subdirectories and add those subfolder names (stripping configured
prefixes from each) into the scopes array; also deduplicate the scopes (e.g.,
via Set) and sort before returning. Ensure you adjust references to the prefixes
variable and the scopes array and keep behavior for apps the same.
---
Nitpick comments:
In @.github/workflows/pr-quality.yaml:
- Around line 21-22: The checkout step ("Checkout repository") currently uses
"actions/checkout@v6" and leaves credentials persisted; update that step to pin
the action to a full commit SHA (replace "`@v6`" with the specific commit SHA for
actions/checkout) and add a "with: persist-credentials: false" entry to disable
token persistence for the workflow (keep the step name "Checkout repository" and
the uses string when locating the change).
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro
Run ID: 17912256-efcb-4486-b753-bcb648a029a0
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (5)
.github/workflows/pr-quality.yaml.husky/commit-msgcommitlint.config.mjspackage.jsonpnpm-workspace.yaml
Coverage Report for Riven
File Coverage
|
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
2 participants
Summary by CodeRabbit