pr-title-lint.yml

name: PR title (Conventional Commits)

# We squash-merge, so the PR title becomes the commit on main and feeds
# release-please / the changelog. Enforce the Conventional Commits format.
#
# SECURITY: this uses `pull_request_target` (read/write token in the base-repo context) on
# purpose — it only reads PR *metadata* (the title) and never checks out or runs PR code.
# Do NOT add `actions/checkout` of the PR head here, or untrusted code would run with that token.
on:
  pull_request_target:
    types: [opened, edited, synchronize, reopened]

permissions:
  contents: read

jobs:
  lint-title:
    runs-on: ubuntu-latest
    permissions:
      pull-requests: read
    steps:
      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
        with:
          # Keep in sync with release-please's changelog-sections below.
          types: |
            feat
            fix
            perf
            refactor
            docs
            test
            build
            ci
            chore
            revert
          requireScope: false
          subjectPattern: ^(?![A-Z]).+$
          subjectPatternError: |
            The subject "{subject}" should start lowercase.