commit-check.yml

name: Commit Check

permissions:
  contents: read

on:
  pull_request:
    branches: 'main'
    types: [opened, synchronize, reopened, edited]
  workflow_dispatch:

jobs:
  commit-check:
    strategy:
      matrix:
        os: [ubuntu-latest, macos-latest, windows-latest]
    runs-on: ${{ matrix.os }}
    permissions:
      contents: read
      pull-requests: write
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0  # Required for merge-base checks
          # Nothing after checkout needs authenticated git.
          persist-credentials: false
      # The install step must never run a pip.py or venv.py from the
      # checkout in place of pip or venv. If it did, these stop the job.
      - name: Plant pip.py and venv.py in the workspace
        shell: bash
        run: |
          for name in pip venv; do
            echo 'raise SystemExit("a workspace module ran in place of pip or venv")' > "$name.py"
          done
      - uses: ./ # self test
        with:
          message: true
          branch: true
          author-name: true
          author-email: true
          # Report from the ubuntu job only. Every leg checks the same commits
          # against the same rules, so the other two produce a byte-identical
          # report — three copies of it on the run page, and the matrix is here
          # to prove the action runs on each OS, not to say the same thing
          # three times.
          job-summary: ${{ matrix.os == 'ubuntu-latest' }}
          pr-comments: ${{ github.event_name == 'pull_request' && matrix.os == 'ubuntu-latest' }}
          pr-title: true
          pr-body-ai-attribution: true
          # One leg is enough: all three would try to add the same label.
          ai-label: ${{ matrix.os == 'ubuntu-latest' }}