ci: fix commitlint workflow and post lint failures as PR comments#735
Merged
Conversation
The commitlint step piped to tee without pipefail, so commitlint's non-zero exit code was masked by tee's success and the step's outcome was always success. Combined with continue-on-error: true, the Show help on failure step never ran and the job passed even when commits violated the convention. Fix the exit-code propagation and add inline PR-comment feedback for lint failures, including for fork PRs, using the split-workflow pattern recommended by GitHub Security Lab to avoid the pwn-request risks of pull_request_target + checkout: - commitlint.yaml stays on: pull_request (unprivileged). Adds set -o pipefail so commitlint's exit code propagates. On failure, uploads the lint output and PR number as an artifact, then exits 1 to fail the check. - commitlint-comment.yaml is a new on: workflow_run workflow (privileged) with pull-requests: write. It never checks out PR code and never runs npm or any build step. It downloads the artifact, validates the PR number against ^[0-9]+$, and posts the lint output as a PR comment inside a fenced code block to neutralize markdown injection from commit messages. Defense in depth: - npm install --ignore-scripts disables preinstall and postinstall scripts on the unprivileged side. - persist-credentials: false strips the writable git credential helper from the checkout. Note: workflow_run workflows only execute from files on the default branch, so end-to-end validation requires a follow-up test PR after this merges.
This was an allowlist for a secret-scanning tool, but no workflow, Makefile, or tooling in the repo references it. The only file that contained the allowlisted "BEGIN PRIVATE KEY" string was .gitallowed itself, so removing it changes nothing about scan results.
bnusunny
force-pushed
the
fix-commitlint-exit-code
branch
from
aeac541 to
ead2306
Compare
seshubaws
reviewed
May 27, 2026
seshubaws
reviewed
May 27, 2026
Resolve PR number from the trusted workflow_run head_sha via the GitHub API instead of reading it from the artifact. The artifact is produced by the unprivileged pull_request workflow whose file fork authors control, so an attacker could otherwise direct the bot comment at a different PR. Size the markdown code fence one backtick longer than the longest backtick run in the lint output, so a commit message containing ``` can no longer escape the fence and inject markdown into the bot comment.
seshubaws
approved these changes
May 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
teemasked commitlint's exit code (nopipefail) andcontinue-on-error: truethen turned the step'soutcomeintosuccess, so the gatingShow help on failurestep never ran. Fixed withset -o pipefail.pull_requestworkflow (commitlint.yaml) that runs the lint and uploads its output as an artifact, and a privilegedworkflow_runworkflow (commitlint-comment.yaml) that downloads the artifact and posts the comment. The privileged workflow never checks out PR code and never runsnpm/build steps, addressing the "pwn request" pattern that CodeQL flags onpull_request_target+ checkout designs.^[0-9]+$before passing it togh pr comment, and render commitlint output inside a fenced code block to neutralize markdown injection from commit messages.--ignore-scriptstonpm installandpersist-credentials: falseto checkout as defense in depth..gitallowed— no workflow or tooling references it, and the only file containing the allowlistedBEGIN PRIVATE KEYstring was.gitalloweditself.Notes
workflow_runworkflows only execute from files on the default branch, so end-to-end validation of the comment-posting step has to happen on a follow-up PR after this one merges.Test plan