conventional-commit-title.yaml

# ------------------------------------------------------------
# Copyright 2026 The Radius Authors.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
# ------------------------------------------------------------

# yaml-language-server: $schema=https://www.schemastore.org/github-workflow.json
---
name: conventional-commit-title

# pull_request_target runs the base branch's copy of this workflow, so a pull
# request cannot weaken this required check by editing it. No pull request code
# is checked out or executed here, so the token never sees untrusted input.
on:
  pull_request_target:
    types:
      - opened
      - edited
      - reopened
      # A required check is evaluated against the head commit, so the check has
      # to re-run when new commits arrive.
      - synchronize
  # A merge group has no pull request title, but the required check must still
  # report there or queued entries stall until the queue check timeout.
  merge_group:
    branches:
      - main

permissions: {}

concurrency:
  group: conventional-commit-title-${{ github.event.pull_request.number || github.sha }}
  # A canceled merge queue check fails the queued entry.
  cancel-in-progress: ${{ github.event_name != 'merge_group' }}

jobs:
  validate-title:
    name: Validate pull request title
    if: github.event_name == 'pull_request_target'
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      pull-requests: read # Required to read the pull request title
      statuses: write # Required for the status the action posts under wip, and the failure status below
    steps:
      - name: Validate Conventional Commit title
        id: validate
        uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
        with:
          # A "[WIP]" title leaves the check pending instead of failing, which
          # blocks merge without nagging an unfinished pull request.
          wip: true
        env:
          GITHUB_TOKEN: ${{ github.token }}

      # Under wip the action leaves the status pending for an invalid title, so
      # the failure is reported explicitly. The action sets error_message only
      # when the title itself failed; a failure without it means the validation
      # never ran, which must block as well but is not a title problem.
      - name: Mark an invalid title as failed
        if: failure() && steps.validate.outcome == 'failure'
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        env:
          ERROR_MESSAGE: ${{ steps.validate.outputs.error_message }}
        with:
          script: |
            const invalidTitle = process.env.ERROR_MESSAGE !== ''
            await github.rest.repos.createCommitStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: context.payload.pull_request.head.sha,
              state: 'failure',
              context: 'action-semantic-pull-request',
              description: invalidTitle
                ? 'PR title validation failed'
                : 'Title validation did not run; see the workflow log',
              target_url: `${context.serverUrl}/${context.repo.owner}/${context.repo.repo}/actions/runs/${context.runId}`,
            })

  validate-merge-group:
    name: Validate pull request title
    if: github.event_name == 'merge_group'
    runs-on: ubuntu-24.04
    timeout-minutes: 5
    permissions:
      statuses: write # Required to report the policy on merge-group commits
    steps:
      - name: Mark title policy satisfied for the merge group
        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
        with:
          script: |
            await github.rest.repos.createCommitStatus({
              owner: context.repo.owner,
              repo: context.repo.repo,
              sha: context.sha,
              state: 'success',
              context: 'action-semantic-pull-request',
              description: 'Pull request titles were validated before queueing',
            })