ci.commit.check.yml

name: "CI: Commit Check"

on:
  pull_request:
    branches: [main]
  # This check runs on every push to repository
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  commit-check:
    runs-on: ubuntu-latest
    permissions:  # use permissions because of use pr-comments
      contents: read
      pull-requests: write
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@58077d3c7e43986b6b15fba718e8ea69e387dfcc # v2.15.1
        with:
          egress-policy: audit
      - name: Checkout code
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ github.event.pull_request.head.sha }}  # checkout PR HEAD commit
          fetch-depth: 0  # required for merge-base check
      - name: Run Commit Check
        uses: commit-check/commit-check-action@443fb6a114414358496e6243105294c3b11610c5 # v2.4.2
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} # use GITHUB_TOKEN because of use pr-comments
        with:
          # Conventional Commits Check
          message: true
          # Convention Branch Check
          branch: false
          author-name: true
          author-email: true
          commit-signoff: false
          merge-base: true
          job-summary: true
          pr-comments: false