commitlint.yml

---
name: 'commitlint'
on:  # yamllint disable-line rule:truthy
  - 'push'
  - 'pull_request'

permissions:
  contents: 'read'

jobs:
  commitlint:
    runs-on: 'ubuntu-latest'
    steps:
      - name: 'Harden Runner'
        uses: 'step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6' # v2.8.1
        with:
          egress-policy: 'block'
          allowed-endpoints: >
            github.com:443
            nodejs.org:443
            registry.npmjs.org:443

      - name: 'Checkout the repository'
        uses: 'actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332' # v4.1.7
        with:
          fetch-depth: 0

      - name: 'Install NodeJS'
        uses: 'actions/setup-node@1e60f620b9541d16bece96c5465dc8ee9832be0b' # v4.0.3
        with:
          # renovate dep: datasource=npm depName=node
          node-version: '20.15.1'

      - name: 'Install commitlint'
        run: |
          # renovate: datasource=npm
          npm install conventional-changelog-conventionalcommits@8.0.0
          # renovate: datasource=npm
          npm install commitlint@19.3.0
          # renovate: datasource=npm
          npm install commitlint-plugin-selective-scope@1.0.1

      - name: 'Validate current commit (last commit) with commitlint'
        if: "github.event_name == 'push'"
        run: 'npx commitlint --last --verbose'

      - name: 'Validate pull request commits with commitlint'
        if: "github.event_name == 'pull_request'"
        run: >-
          npx commitlint --from ${{ github.event.pull_request.head.sha }}~${{ github.event.pull_request.commits }}
          --to ${{ github.event.pull_request.head.sha }} --verbose
...