commit-msg-check.yml

name: Commit message check

on:
  push:
    branches: [main]
  pull_request:
  workflow_dispatch:

permissions:
  contents: read

jobs:
  check:
    name: Reject double-stamped commit subjects
    runs-on: ubuntu-latest
    timeout-minutes: 2
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Validate commit messages in the pushed range
        env:
          BEFORE_SHA: ${{ github.event.before }}
          AFTER_SHA: ${{ github.event.after }}
          PR_BASE_SHA: ${{ github.event.pull_request.base.sha }}
          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
        run: |
          set -euo pipefail

          if [ -n "${PR_HEAD_SHA:-}" ] && [ -n "${PR_BASE_SHA:-}" ]; then
            range="${PR_BASE_SHA}..${PR_HEAD_SHA}"
          elif [ "${BEFORE_SHA:-}" = "0000000000000000000000000000000000000000" ] || [ -z "${BEFORE_SHA:-}" ]; then
            range="${AFTER_SHA}~1..${AFTER_SHA}"
          else
            range="${BEFORE_SHA}..${AFTER_SHA}"
          fi
          echo "Validating commits in range: $range"

          pattern='\([0-9]{4}\.[0-9]+\.[0-9]+\.[0-9]+(-([A-Fa-f0-9]{4}|beta))?\)'

          failures=0
          while IFS= read -r line; do
            sha="${line%% *}"
            subject="${line#* }"
            count=$( ( printf '%s\n' "$subject" | grep -oE "$pattern" || true ) | grep -c . || true )
            count=${count//[^0-9]/}
            count=${count:-0}
            if [ "$count" -gt 1 ]; then
              echo "::error::Commit $sha has $count build-version stamps in its subject:"
              echo "::error::  $subject"
              failures=$((failures + 1))
            fi
          done < <(git log --format='%H %s' "$range")

          if [ "$failures" -gt 0 ]; then
            echo ""
            echo "::error::$failures commit(s) carry more than one build-version stamp."
            echo "Reword the offending commits to drop stale version trailers."
            exit 1
          fi

          echo "All commit subjects in $range carry at most one build-version stamp."