Skip to content

fix: use pull_request_target for PR title linting #689

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dlevy-msft-sql wants to merge 3 commits into from
Closed

fix: use pull_request_target for PR title linting #689

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
4f756be
fix: use pull_request_target for PR title linting
dlevy-msft-sql Feb 1, 2026
41962f3
style: add copyright header and version comment
dlevy-msft-sql Feb 2, 2026
00fb1ce
Merge branch 'main' into fix/pr-title-lint-permissions
dlevy-msft-sql Feb 2, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
24 changes: 24 additions & 0 deletions .github/workflows/pr-title-lint.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,24 @@
# Copyright (c) Microsoft Corporation.
# Licensed under the MIT license.

name: PR Title Lint

on:
pull_request_target:
types: [opened, edited, synchronize, reopened]
Copy link

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The 'synchronize' event type is unnecessary for PR title linting. This event triggers when new commits are pushed to the PR, but the PR title doesn't change during synchronization. This will cause the workflow to run unnecessarily on every commit push.

Consider removing 'synchronize' from the types list to avoid redundant workflow runs. The workflow should only run when the PR title can actually change: 'opened', 'edited', and 'reopened'.

Suggested change
types: [opened, edited, synchronize, reopened]
types: [opened, edited, reopened]

Copilot uses AI. Check for mistakes.

permissions:
pull-requests: read
statuses: write

jobs:
lint:
name: Validate PR Title
runs-on: ubuntu-latest
steps:
- name: Check PR title follows Conventional Commits
# Pinned to commit SHA for supply chain security (CWE-829)
# Verify: gh api repos/amannn/action-semantic-pull-request/git/ref/tags/v5.5.3 --jq '.object.sha'
uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
Copy link

Copilot AI Feb 2, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Consider adding configuration to customize the Conventional Commits validation if the project has specific requirements. The action supports several configuration options (e.g., custom types, scopes, subject pattern) that can be specified with 'with:' parameters.

For example, if the project wants to enforce specific commit types (feat, fix, docs, etc.) or require scopes, these can be configured. Review the action's documentation to determine if the default configuration meets the project's needs.

Suggested change
uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3
with:
types: |
feat
fix
docs
style
refactor
perf
test
build
ci
chore
revert
requireScope: false

Copilot uses AI. Check for mistakes.
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
Loading