Skip to content

Conversation

@utnapischtim
Copy link
Contributor

@utnapischtim utnapischtim commented Jul 26, 2025

uses: actions/checkout@v4

- name: commitlint
uses: wagoid/commitlint-github-action@v6
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

minor: for 3rd-party action (i.e. those that are not under the "official" actions/ namespace), I prefer that we reference them by their commit hash with the intedned tag/version in a comment

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

To be clear, using the commit hash is for security + breaking change shield purposes, right? As in, we use v6 and a rogue action update to 6.1 introduces a vulnerability or breaks the CI? (must admit that for our own repos and at least docs-invenio-rdm I haven't been that paranoid )

- name: Checkout
uses: actions/checkout@v4

- name: commitlint
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure what the default config is for commitlint, but I see there are many of flexible options and even "shared configurations" (similar to ESLint).

I would prefer that we have a "global" config with the set of allowed types (i.e. chore, feat, fix, etc.). Regarding topics (i.e. whatever goes in fix(<topic>): ...) I see that we:

  • have a set of global topics
  • repo-specific topics where applicable via their own .commitlintrc?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants