ci: fix commitlint workflow and post lint failures as PR comments (#735)

Author: bnusunny

.gitallowed

@@ -0,0 +1,108 @@
+name: Commit Lint Comment
+
+# Privileged follow-up to commitlint.yaml. Triggered by completion of the
+# unprivileged Commit Lint workflow; downloads the lint output artifact and
+# posts it as a PR comment. This split is the recommended pattern for safely
+# performing privileged operations in response to fork PRs:
+# https://securitylab.github.com/research/github-actions-preventing-pwn-requests/
+#
+# Security: this workflow does not check out PR code. The PR number is
+# resolved from the trusted workflow_run event payload (not the artifact),
+# and the commitlint text output is rendered inside a dynamically sized
+# code fence so embedded backticks cannot escape it.
+on:
+  workflow_run:
+    workflows: ["Commit Lint"]
+    types:
+      - completed
+
+permissions:
+  contents: read
+  pull-requests: write
+  actions: read
+
+jobs:
+  comment:
+    name: Comment on PR
+    if: >
+      github.event.workflow_run.event == 'pull_request' &&
+      github.event.workflow_run.conclusion == 'failure'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Download lint artifact
+        id: download
+        uses: actions/download-artifact@v4
+        with:
+          name: commitlint-failure
+          path: lint-artifact
+          run-id: ${{ github.event.workflow_run.id }}
+          github-token: ${{ secrets.GITHUB_TOKEN }}
+        continue-on-error: true
+
+      - name: Skip if no artifact
+        if: steps.download.outcome != 'success'
+        run: |
+          echo "No commitlint-failure artifact uploaded by the Commit Lint run; nothing to comment."
+
+      - name: Resolve PR number from workflow_run
+        if: steps.download.outcome == 'success'
+        id: pr
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          HEAD_SHA: ${{ github.event.workflow_run.head_sha }}
+          REPO: ${{ github.repository }}
+        shell: bash
+        run: |
+          # Derive PR number from trusted GitHub event data, not the artifact.
+          # The artifact is produced by an unprivileged pull_request workflow
+          # whose workflow file PR authors control on fork PRs, so any value
+          # they write into the artifact could be used to spoof comments onto
+          # a different PR. head_sha on the workflow_run event is GitHub-set
+          # and trustworthy.
+          pr=$(gh api "repos/$REPO/commits/$HEAD_SHA/pulls" \
+                 --jq '.[] | select(.state=="open") | .number' | head -n1)
+          if ! [[ "$pr" =~ ^[0-9]+$ ]]; then
+            echo "No open PR found for head SHA $HEAD_SHA; nothing to comment."
+            exit 0
+          fi
+          echo "pr_number=$pr" >> "$GITHUB_OUTPUT"
+
+      - name: Post comment
+        if: steps.download.outcome == 'success' && steps.pr.outputs.pr_number != ''
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_NUMBER: ${{ steps.pr.outputs.pr_number }}
+          REPO: ${{ github.repository }}
+        shell: bash
+        run: |
+          # The artifact contents are untrusted PR-author-controlled commit
+          # text. Pick a code-fence length that is at least one backtick
+          # longer than the longest backtick run in the file, so the author
+          # cannot escape the fence by embedding ``` in a commit message.
+          max_ticks=$(grep -oE '`+' lint-artifact/commitlint-output.txt 2>/dev/null \
+                        | awk '{ if (length > m) m = length } END { print m+0 }')
+          fence_len=$((max_ticks + 1))
+          [ "$fence_len" -lt 3 ] && fence_len=3
+          fence=$(printf '`%.0s' $(seq 1 "$fence_len"))
+          {
+            echo "## Commit message lint failed"
+            echo ""
+            echo "One or more commit messages don't follow the [Conventional Commits](https://www.conventionalcommits.org) format required by this project."
+            echo ""
+            echo "<details><summary>commitlint output</summary>"
+            echo ""
+            echo "$fence"
+            cat lint-artifact/commitlint-output.txt
+            echo "$fence"
+            echo ""
+            echo "</details>"
+            echo ""
+            echo "**Required format:** \`<type>: <description>\` (max 120 chars for the header)"
+            echo ""
+            echo "**Allowed types:** \`feat\`, \`fix\`, \`docs\`, \`example\`, \`examples\`, \`chore\`, \`refactor\`, \`perf\`, \`test\`, \`ci\`, \`revert\`"
+            echo ""
+            echo "To fix the most recent commit: \`git commit --amend\`"
+            echo ""
+            echo "To reword older commits: \`git rebase -i origin/main\`"
+          } > comment.md
+          gh pr comment "$PR_NUMBER" --repo "$REPO" --body-file comment.md

.github/workflows/commitlint-comment.yaml

@@ -17,21 +17,32 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
+          persist-credentials: false
 
       - name: Setup Node.js
         uses: actions/setup-node@v4
         with:
           node-version: 20
 
       - name: Install commitlint
-        run: npm install --save-dev @commitlint/{cli,config-conventional}
+        run: npm install --ignore-scripts --save-dev @commitlint/{cli,config-conventional}
 
       - name: Lint commits
         id: lint
+        shell: bash
         run: |
+          set -o pipefail
           npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose 2>&1 | tee commitlint-output.txt
         continue-on-error: true
 
+      - name: Upload lint output
+        if: steps.lint.outcome == 'failure'
+        uses: actions/upload-artifact@v4
+        with:
+          name: commitlint-failure
+          path: commitlint-output.txt
+          retention-days: 1
+
       - name: Show help on failure
         if: steps.lint.outcome == 'failure'
         run: |