ci: lint PR conventions and polish CI workflows by Astro-Han · Pull Request #72 · Astro-Han/pawwork

Astro-Han · 2026-04-20T14:27:27Z

Summary

docs(ci): one-line comment at every setup-node usage documenting it is load-bearing ([Feature] Drop actions/setup-node from bun-only CI jobs #70) — bun install triggers trustedDependencies postinstalls (electron, node-pty, esbuild, tree-sitter) that call node explicitly. Comment anchors to trustedDependencies in package.json so the list stays grep-able.
ci: new advisory pr-title-lint workflow using amannn/action-semantic-pull-request@v6.1.1 (SHA-pinned) to validate PR titles against Conventional Commits ([Feature] Enforce Conventional Commits on PR titles #68).
ci: new advisory commit-lint workflow using wagoid/commitlint-github-action@v6.2.1 (SHA-pinned) with .commitlintrc.json extending @commitlint/config-conventional ([Feature] Enforce Conventional Commits on commit messages #69).
ci: flip dependency-review's comment-summary-in-pr from always to never; drop the fork-skip guard and pull-requests: write permission (both only existed because of the always-on summary). Fork PRs now get advisory CVE/license coverage too.

Why

Issue #54 (the CI merge-gate hardening epic) left four loose ends. This PR closes #67, #68, #69, and #70 in a single batch since all four are small workflow-level changes with no logical dependencies. Also folds in a small dependency-review cleanup: the always-on PR summary was useful during the initial rollout on #55 to verify bun.lock parses correctly, but it has served its purpose and is noise on every PR now.

AGENTS.md convention was updated in a prior local edit: PR titles switched from the old [Feature]/[Bug] scheme to Conventional Commits; issue titles still use [Feature]/[Bug] via .github/ISSUE_TEMPLATE/*.yml.

Decisions declined during two rounds of crosscheck review: re-adding synchronize to pr-title-lint (title does not change on push); dropping fetch-depth: 0 on commit-lint (wagoid uses local git log, not the API); dropping wip: true (safe under merge-commit strategy); merging pr-title-lint and commit-lint into one file (mixed pull_request_target / pull_request security contexts); switching commit-lint to bunx commitlint inside ci.yml (real alternative but adds devDep; deferred).

Related Issue

Closes #67
Closes #68
Closes #69
Closes #70

How To Verify

# The PR itself is the smoke test:
# - pr-title-lint runs against this PR title (Conventional Commits -> pass)
# - commit-lint runs against the 4 commits on this branch (all Conventional -> pass)
# - dependency-review job runs green without posting a PR comment
# - ci / check, desktop-smoke / check, codeql / analyze-js-ts stay green
#   (no semantic change to their existing jobs)

test:ci exit-code audit for #67 is recorded as an issue comment on #67; bun test --reporter=junit was empirically verified to exit non-zero on a failing test.

Screenshots or Recordings

No UI changes.

Checklist

I ran the relevant verification steps
I tested visible changes manually when needed
I am targeting the dev branch

Summary by CodeRabbit

Chores
- Configured Commitlint to enforce conventional commit message rules
- Implemented PR title linting requiring conventional commit format (e.g., feat:, fix:, refactor:)
- Adjusted dependency review workflow to reduce required permissions and reporting

Audit found all four entries in the root package.json `trustedDependencies` (electron, node-pty, esbuild, tree-sitter) have install/postinstall scripts that invoke `node` directly, so `bun install` needs node in PATH to succeed. Dropping setup-node from any job that runs `bun install` would silently fail those postinstalls. Add a short comment at every setup-node usage pointing at the `trustedDependencies` field so the invariant is grep-able and the comment stays accurate if the trusted list changes.

Add an advisory workflow that fails the check when a PR title does not start with a Conventional Commits type (`feat:`, `fix:`, `refactor:`, `docs:`, `chore:`, `ci:`, `build:`, `perf:`, `test:`, `style:`, `revert:`). Not added to the `dev` ruleset; advisory only. Uses `pull_request_target` so the check runs when a PR opens from a fork (the workflow copy on `dev` runs, not the fork's). Permissions are scoped to read-only and no fork code is checked out, so the usual `pull_request_target` injection concerns do not apply. Triggers on `opened`/`edited`/`reopened`/`ready_for_review`. `synchronize` is omitted because the title does not change on new commits. `wip: true` skips draft PRs whose title starts with `WIP:`; safe because this repo uses merge commits, so the PR title is not the commit subject on `dev`. Concurrency group cancels superseded runs on rapid title edits.

Add an advisory workflow using wagoid/commitlint-github-action (bundles @commitlint/config-conventional) to validate every commit in a PR against Conventional Commits. Pairs with pr-title-lint.yml -- the title check only sees the PR title, while this catches intermediate commits that would land on `dev` under the merge-commit strategy. Config lives in .commitlintrc.json. Merge commits are ignored by commitlint's defaults. Not required in the `dev` ruleset; advisory only. `pull-requests: read` is declared defensively in case the action ever switches from reading local git history to the PR commits API; `fetch-depth: 0` is preserved because the current action implementation uses git log. Concurrency group cancels superseded runs.

`comment-summary-in-pr: always` combined with `warn-only: true` means every PR gets a summary comment even when there are no findings. Since the bun.lock parse rollout on PR #55 confirmed the action is working, the always-on summary is pure noise now. Switch to `never`; findings still show in the Actions log. The fork guard and `pull-requests: write` permission are also removed -- they existed only to avoid a write-access error on fork PRs under the always-on summary, which no longer applies. Fork PRs now get advisory coverage too, which is exactly where it is most useful. CVE/license gating remains advisory (warn-only). Upgrading to fail-on-severity is a separate decision.

coderabbitai · 2026-04-20T14:27:44Z

Warning

Rate limit exceeded

@Astro-Han has exceeded the limit for the number of commits that can be reviewed per hour. Please wait 12 minutes and 59 seconds before requesting another review.

Your organization is not enrolled in usage-based pricing. Contact your admin to enable usage-based pricing to continue reviews beyond the rate limit, or try again in 12 minutes and 59 seconds.

⌛ How to resolve this issue?

After the wait time has elapsed, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

We recommend that you space out your commits to avoid hitting the rate limit.

🚦 How do rate limits work?

CodeRabbit enforces hourly rate limits for each developer per organization.

Our paid plans have higher rate limits than the trial, open-source and free plans. In all cases, we re-allow further reviews after a brief timeout.

Please see our FAQ for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: f9eb28a2-2928-474c-9e54-eaeb0e1fcbcd

📥 Commits

Reviewing files that changed from the base of the PR and between fd00a23 and 09dd83f.

📒 Files selected for processing (1)

.commitlintrc.json

📝 Walkthrough

Walkthrough

This change introduces Conventional Commits enforcement for PR titles and commit messages through two new GitHub Actions workflows, adds a Commitlint configuration file, inserts explanatory comments across workflow files documenting bun install and Node dependencies, and modifies the dependency-review workflow to reduce permissions and change PR comment behavior.

Changes

Cohort / File(s)	Summary
Commitlint Configuration `.commitlintrc.json`	New file establishing Conventional Commits linting rules via `@commitlint/config-conventional` preset for commit message validation.
Commit Message Linting Workflow `.github/workflows/commit-lint.yml`	New workflow that lints commit messages in PRs against Conventional Commits conventions, runs on PR events targeting `dev` branch with full git history, and uses `wagoid/commitlint-github-action` with the `.commitlintrc.json` config.
PR Title Linting Workflow `.github/workflows/pr-title-lint.yml`	New workflow that enforces Conventional Commits style PR titles (e.g., `feat:`, `fix:`, `refactor:`), runs on PR events targeting `dev` branch, uses `amannn/action-semantic-pull-request`, supports WIP draft detection, and validates title format (3+ characters, non-space start).
Dependency Review Workflow `.github/workflows/dependency-review.yml`	Adjusted workflow permissions from `write` to `read` for pull-requests, removed fork-only execution conditional, changed PR comment behavior from `always` to `never`, and shifted to advisory-only advisory logging mode.
Workflow Documentation Comments `.github/workflows/build.yml`, `.github/workflows/ci.yml`, `.github/workflows/desktop-smoke.yml`, `.github/workflows/e2e-artifacts.yml`	Added inline comments before `actions/setup-node` steps documenting that `bun install` triggers `trustedDependencies` postinstall scripts that explicitly invoke `node`, cautioning against removal without patching scripts and referencing issue `#70`.

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~15 minutes

Poem

🐰 Commits now follow the righteous path,
With PR titles tamed by linting's wrath,
No more rogue messages left unadorned—
Conventional rules we've sworn!
Hop along, dear workflows, clean and bright! ✨

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title accurately describes the main changes: linting PR conventions (via pr-title-lint and commit-lint workflows) and polishing CI workflows (comments, dependency-review updates).
Description check	✅ Passed	The description comprehensively covers all template sections: detailed Summary of changes, clear Why rationale, Related Issues links, How To Verify steps, and completed Checklist.
Linked Issues check	✅ Passed	All four linked issues are addressed: `#67` audit noted in comment, `#68/`#69 implemented via pr-title-lint and commit-lint workflows with SHA-pinning, `#70` handled by setup-node comments explaining trustedDependencies necessity.
Out of Scope Changes check	✅ Passed	All changes are scoped to the four linked issues: workflow additions (pr-title-lint, commit-lint), documentation comments (setup-node), and dependency-review permission/config adjustments. No unrelated changes detected.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch worktree-ci-polish

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request introduces a .commitlintrc.json configuration file to enforce conventional commit standards using the @commitlint/config-conventional preset. Feedback suggests enhancing the configuration by adding a JSON schema for IDE autocompletion and disabling the subject-case rule to prevent linting errors when using acronyms like PR or CI in commit messages.

Points at json.schemastore.org so editors offer autocompletion and validation for the commitlint config. Runtime behavior unchanged; CI still reads `extends` the same way. Addressed from gemini-code-assist review on PR #72.

Astro-Han added 4 commits April 20, 2026 22:25

Astro-Han added enhancement New feature or request ci Continuous integration / GitHub Actions P2 Medium priority labels Apr 20, 2026

gemini-code-assist Bot reviewed Apr 20, 2026

View reviewed changes

Comment thread .commitlintrc.json

chore: add $schema to .commitlintrc.json

09dd83f

Points at json.schemastore.org so editors offer autocompletion and validation for the commitlint config. Runtime behavior unchanged; CI still reads `extends` the same way. Addressed from gemini-code-assist review on PR #72.

Astro-Han mentioned this pull request Apr 20, 2026

[Feature] Speed up ci / unit job #74

Closed

Astro-Han merged commit 5e39f90 into dev Apr 20, 2026
14 checks passed

Astro-Han deleted the worktree-ci-polish branch April 20, 2026 14:41

This was referenced Apr 22, 2026

ci: split package unit jobs #125

Merged

docs: update README positioning #212

Merged

chore(deps): bump actions/setup-node from 6.3.0 to 6.4.0 #257

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

ci: lint PR conventions and polish CI workflows#72

ci: lint PR conventions and polish CI workflows#72
Astro-Han merged 5 commits into
devfrom
worktree-ci-polish

Astro-Han commented Apr 20, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Apr 20, 2026 •

edited

Loading

Rate limit exceeded

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Astro-Han commented Apr 20, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Why

Related Issue

How To Verify

Screenshots or Recordings

Checklist

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Apr 20, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Rate limit exceeded

Walkthrough

Changes

Estimated code review effort

Poem

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Astro-Han commented Apr 20, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Apr 20, 2026 •

edited

Loading