action.yml

name: Commit Check Action
description: Check commit message formatting, branch naming, committer name, email, and more
author: shenxianpeng
branding:
  icon: "git-commit"
  color: "blue"
inputs:
  message:
    description: check git commit message following conventional commits
    required: false
    default: true
  branch:
    description: check git branch name following conventional branch
    required: false
    default: true
  author-name:
    description: check committer author name
    required: false
    default: false
  author-email:
    description: check committer author email
    required: false
    default: false
  dry-run:
    description: report failures (summary, PR comment, annotations as warnings) but always exit 0
    required: false
    default: false
  job-summary:
    description: display job summary to the workflow run
    required: false
    default: true
  pr-comments:
    description: post results to the pull request comments
    required: false
    default: false
  pr-title:
    description: check pull request title following conventional commits
    required: false
    default: false
outputs:
  result:
    description: Structured check results as JSON (status pass/warn/skip/fail + per-scope label, sha and checks). Consume with fromJSON(steps.<id>.outputs.result).
    # Composite actions do not forward step outputs automatically: without this
    # mapping (and the step id it refers to) the output is always the empty
    # string, and fromJSON('') fails the calling workflow.
    value: ${{ steps.commit-check.outputs.result }}

runs:
  using: "composite"
  steps:
    - name: Install dependencies and run commit-check
      id: commit-check
      shell: bash
      run: |
        # Platform-specific settings
        if [[ "$RUNNER_OS" == "Windows" ]]; then
          PYTHON_CMD="python"
        else
          if [[ "$RUNNER_OS" == "Linux" ]]; then
            # https://github.com/pypa/setuptools/issues/3269
            export DEB_PYTHON_INSTALL_LAYOUT=deb
          fi
          PYTHON_CMD="python3"
        fi

        # Everything the action installs lives under $RUNNER_TEMP, never in the
        # caller's checkout: a later `git status`, linter or upload-artifact step
        # must not see our venv or wheels.
        WORK="$RUNNER_TEMP/commit-check-action"
        rm -rf "$WORK"   # a second invocation in the same job starts clean, so the wheel glob below matches exactly one file
        mkdir -p "$WORK/wheels"
        $PYTHON_CMD -m venv "$WORK/venv"
        if [[ "$RUNNER_OS" == "Windows" ]]; then
          source "$WORK/venv/Scripts/activate"
        else
          source "$WORK/venv/bin/activate"
        fi

        # One download of the pinned closure, into the scratch dir. Wheels only:
        # the offline install below cannot build an sdist, so a platform without
        # binary wheels fails here, with pip's message, rather than later.
        $PYTHON_CMD -m pip download -q --only-binary=:all: -d "$WORK/wheels" -r "$GITHUB_ACTION_PATH/requirements.txt"

        # Verify the commit-check wheel's build provenance (PyGithub and the
        # transitive wheels are pinned but not attested; see README "Runner requirements").
        WHEEL=$(ls "$WORK"/wheels/commit_check-*.whl)   # exactly one: pip download of a == pin
        if ! gh attestation verify "$WHEEL" -R commit-check/commit-check; then
          echo "::error::Attestation verification failed for $(basename "$WHEEL") (self-hosted runners need the gh CLI). Aborting installation."
          exit 1
        fi

        # Install offline from the wheels we already downloaded and verified:
        # no second trip to PyPI, and the installed set is exactly the downloaded set.
        $PYTHON_CMD -m pip install -q --no-cache-dir --no-index --find-links "$WORK/wheels" -r "$GITHUB_ACTION_PATH/requirements.txt"

        $PYTHON_CMD "$GITHUB_ACTION_PATH/main.py"
      env:
        MESSAGE: ${{ inputs.message }}
        BRANCH: ${{ inputs.branch }}
        AUTHOR_NAME: ${{ inputs.author-name }}
        AUTHOR_EMAIL: ${{ inputs.author-email }}
        DRY_RUN: ${{ inputs.dry-run }}
        JOB_SUMMARY: ${{ inputs.job-summary }}
        PR_COMMENTS: ${{ inputs.pr-comments }}
        PR_TITLE: ${{ inputs.pr-title }}
        GITHUB_TOKEN: ${{ github.token }}