commit-linter.yml

---
name: Commit Linter

on:
    push:
        branches:
            - main
    pull_request:
        types:
            - opened
            - reopened
            - synchronize

permissions: # added using https://github.com/step-security/secure-workflows
    contents: read

jobs:
    lint-commits:
        if: "!contains(github.event.head_commit.message, 'bump(release)')"
        permissions:
            contents: read # for actions/checkout to fetch code
            pull-requests: read # for wagoid/commitlint-github-action to get commits in PR
        runs-on: ubuntu-latest
        steps:
            - name: Harden Security Runner
              uses: step-security/harden-runner@v2
              with:
                  egress-policy: block
                  allowed-endpoints: >
                      api.github.com:443
                      github.com:443

            - name: Checkout repository
              uses: actions/checkout@v4
              with:
                  fetch-depth: 0

            - name: Lint commits
              uses: wagoid/commitlint-github-action@v6