feat(githooks): add commitlint, husky and commitizen setup - #59
Closed
DurgaPrasad-54 wants to merge 3 commits into
Closed
feat(githooks): add commitlint, husky and commitizen setup#59DurgaPrasad-54 wants to merge 3 commits into
DurgaPrasad-54 wants to merge 3 commits into
Conversation
📝 WalkthroughWalkthroughAdds Husky git hooks for commit-msg and pre-commit, a commitlint configuration, commit/prepare scripts and devDependencies in package.json, a lint-staged mapping, and a GitHub Actions workflow to run commitlint on pull requests. Changes
Sequence Diagram(s)sequenceDiagram
participant Dev as Developer
participant Git as Local Git
participant Husky as Husky
participant LintStaged as lint-staged
participant Commitlint as commitlint
participant GH as GitHub Actions
Dev->>Git: create commit / push PR
Git->>Husky: run pre-commit hook
Husky->>LintStaged: run npx lint-staged
LintStaged-->>Husky: exit status (pass/fail)
Husky-->>Git: allow or abort commit
Dev->>GH: open PR
GH->>Commitlint: checkout + determine range
GH->>Commitlint: run commitlint --from=base --to=head
Commitlint-->>GH: report results
GH-->>GitHub: mark check pass/fail
Estimated code review effort🎯 3 (Moderate) | ⏱️ ~20 minutes Possibly related issues
Poem
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (3)
package.json (2)
98-98: Remove the duplicatexlsxdeclaration.Line 98 re-declares
xlsxeven though it already exists independenciesat Line 70. Keeping the same package in both sections with different version specs makes future upgrades ambiguous.Suggested change
- "xlsx": "^0.13.0", "@commitlint/cli": "^19.8.0",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` at line 98, There is a duplicate dependency declaration for the package "xlsx"; remove the redundant entry so only one "xlsx" remains (keep the existing entry in dependencies with version "^0.13.0" and delete the second declaration), then update lockfiles by running your package manager (npm install or yarn install) to ensure versions are consistent.
15-15: Skip Husky installation during CI installs.Line 15 runs on every
npm install, including the PR workflow’s install step. Installing local git hooks in CI is unnecessary and can make the pipeline more brittle than it needs to be.Suggested change
- "prepare": "husky install", + "prepare": "[ -n \"$CI\" ] || husky install",🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@package.json` at line 15, The current "prepare" npm script runs husky install on every npm install (including CI); change the script so husky is skipped in CI by checking an environment flag before running husky. Update the "prepare" script string (the value for the "prepare" key) to short-circuit when HUSKY_SKIP_INSTALL or CI is set (for example: only run husky install when HUSKY_SKIP_INSTALL != "1" and CI != "true"), or alternatively remove the global prepare entry and run husky install only in developer setup steps (e.g., local docs or a dev-specific script) so CI installs no git hooks. Ensure you edit the "prepare" script in package.json (the "prepare" key) to implement this conditional skip..husky/pre-commit (1)
1-1: Use the samenpx --noguard here as in the commit-msg hook.Plain
npxcan fall back to an on-demand install, which makes local commits depend on registry/network state. Using the same guarded form as.husky/commit-msgkeeps hook execution deterministic.Suggested change
-npx lint-staged +npx --no -- lint-staged🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.husky/pre-commit at line 1, The pre-commit hook currently runs "npx lint-staged" which can trigger an on-demand install; change it to the guarded form used in the commit-msg hook (e.g., replace "npx lint-staged" with "npx --no-install lint-staged" or the exact "--no" variant used in .husky/commit-msg) so the hook will fail fast instead of attempting network installs; update .husky/pre-commit accordingly and verify locally by running the hook to ensure it behaves deterministically.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@commitlint.config.js`:
- Around line 4-7: Change the two commitlint rules 'body-leading-blank' and
'footer-leading-blank' from severity 1 to severity 2 so they become errors like
the other formatting rules; locate the rule entries named body-leading-blank and
footer-leading-blank in the commitlint config (currently set to [1, 'always'])
and update them to [2, 'always'] to ensure the commit-msg hook fails on missing
blank lines.
---
Nitpick comments:
In @.husky/pre-commit:
- Line 1: The pre-commit hook currently runs "npx lint-staged" which can trigger
an on-demand install; change it to the guarded form used in the commit-msg hook
(e.g., replace "npx lint-staged" with "npx --no-install lint-staged" or the
exact "--no" variant used in .husky/commit-msg) so the hook will fail fast
instead of attempting network installs; update .husky/pre-commit accordingly and
verify locally by running the hook to ensure it behaves deterministically.
In `@package.json`:
- Line 98: There is a duplicate dependency declaration for the package "xlsx";
remove the redundant entry so only one "xlsx" remains (keep the existing entry
in dependencies with version "^0.13.0" and delete the second declaration), then
update lockfiles by running your package manager (npm install or yarn install)
to ensure versions are consistent.
- Line 15: The current "prepare" npm script runs husky install on every npm
install (including CI); change the script so husky is skipped in CI by checking
an environment flag before running husky. Update the "prepare" script string
(the value for the "prepare" key) to short-circuit when HUSKY_SKIP_INSTALL or CI
is set (for example: only run husky install when HUSKY_SKIP_INSTALL != "1" and
CI != "true"), or alternatively remove the global prepare entry and run husky
install only in developer setup steps (e.g., local docs or a dev-specific
script) so CI installs no git hooks. Ensure you edit the "prepare" script in
package.json (the "prepare" key) to implement this conditional skip.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: bf84f9c8-77ed-46ec-8800-bf7933974053
📒 Files selected for processing (4)
.husky/commit-msg.husky/pre-commitcommitlint.config.jspackage.json
There was a problem hiding this comment.
Actionable comments posted: 1
🧹 Nitpick comments (1)
.github/workflows/commit-lint.yml (1)
1-9: Declare read-only workflow permissions explicitly.This job only needs repository read access. Without a top-level
permissionsblock, theGITHUB_TOKENscope depends on repo defaults, which is broader than necessary for a lint-only workflow.🔒 Proposed change
name: Lint Commit Messages + +permissions: + contents: read on: pull_request: types: [opened, synchronize, reopened]🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/commit-lint.yml around lines 1 - 9, The workflow grants default GITHUB_TOKEN scopes; add a top-level permissions block to restrict token to read-only repository access for this lint-only job: insert a top-level "permissions" mapping with "contents: read" (applies to the entire workflow) so the "Lint Commit Messages" workflow and the "commitlint" job run with minimal repo read privileges and no broader write permissions.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In @.github/workflows/commit-lint.yml:
- Around line 12-18: The checkout step currently checks out the contributor fork
and can miss the base commit used by commitlint --from; update the "Checkout
code with submodule" step to check out the base repository at the PR head commit
(set repository to ${{ github.event.pull_request.base.repo.full_name }} and ref
to ${{ github.event.pull_request.head.sha }}) with fetch-depth: 0, and add an
explicit fetch step before running commitlint that fetches the base branch
(e.g., run: git fetch --no-tags --prune --depth=0 origin ${{
github.event.pull_request.base.ref }}) so that the base SHA referenced by
commitlint --from (github.event.pull_request.base.sha) exists locally.
---
Nitpick comments:
In @.github/workflows/commit-lint.yml:
- Around line 1-9: The workflow grants default GITHUB_TOKEN scopes; add a
top-level permissions block to restrict token to read-only repository access for
this lint-only job: insert a top-level "permissions" mapping with "contents:
read" (applies to the entire workflow) so the "Lint Commit Messages" workflow
and the "commitlint" job run with minimal repo read privileges and no broader
write permissions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 8907a66b-05d2-4955-a7fd-b690c6e87ee3
📒 Files selected for processing (2)
.github/workflows/commit-lint.ymlcommitlint.config.js
🚧 Files skipped from review as they are similar to previous changes (1)
- commitlint.config.js
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.github/workflows/commit-lint.yml (2)
8-9: Pin the job token to read-only permissions.This workflow only needs repository reads, so declaring
contents: readavoids relying on whatever the repo/org defaultGITHUB_TOKENscope happens to be.🔐 Proposed hardening
jobs: commitlint: + permissions: + contents: read runs-on: ubuntu-latest🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/commit-lint.yml around lines 8 - 9, Update the commitlint GitHub Actions job to restrict GITHUB_TOKEN scope by adding a permissions block for that job (the commitlint job) and set contents: read so the job only has repository read permissions; ensure the permissions block is placed at the job level (under the commitlint job definition) rather than relying on repo/org defaults.
22-23: Prefernpm cihere if the lockfile is committed.For CI,
npm ci --legacy-peer-depsis more reproducible thannpm install --legacy-peer-depsand avoids resolver drift between runs.📦 Proposed change
- name: Install dependencies - run: npm install --legacy-peer-deps + run: npm ci --legacy-peer-deps🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In @.github/workflows/commit-lint.yml around lines 22 - 23, Replace the "Install dependencies" step that currently runs `npm install --legacy-peer-deps` with `npm ci --legacy-peer-deps` to ensure reproducible installs in CI; if the repo may not always include a lockfile, add a guard/check for a committed lockfile (package-lock.json or npm-shrinkwrap.json) or fall back to `npm install --legacy-peer-deps` so the workflow doesn't fail when the lockfile is missing.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In @.github/workflows/commit-lint.yml:
- Around line 8-9: Update the commitlint GitHub Actions job to restrict
GITHUB_TOKEN scope by adding a permissions block for that job (the commitlint
job) and set contents: read so the job only has repository read permissions;
ensure the permissions block is placed at the job level (under the commitlint
job definition) rather than relying on repo/org defaults.
- Around line 22-23: Replace the "Install dependencies" step that currently runs
`npm install --legacy-peer-deps` with `npm ci --legacy-peer-deps` to ensure
reproducible installs in CI; if the repo may not always include a lockfile, add
a guard/check for a committed lockfile (package-lock.json or
npm-shrinkwrap.json) or fall back to `npm install --legacy-peer-deps` so the
workflow doesn't fail when the lockfile is missing.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 377d42d9-12c2-43fb-98ae-484c7f586518
📒 Files selected for processing (1)
.github/workflows/commit-lint.yml
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
📋 Description
JIRA ID:
This PR introduces commit message linting and automation to enforce a standardized commit structure across the repository. It integrates Commitlint, Husky, and Commitizen to ensure contributors follow the Conventional Commits specification.
✅ Type of Change
Summary by CodeRabbit