commit-check-action fails to halt pipeline when validation rules are violated

[ruzickap]

I'm using a simple GitHub Actions workflow and a minimal commit-check.toml configuration since most defaults work well:

.github/workflows/commit-check.yml:

name: commit-check

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions: read-all

jobs:
  commit-check:
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

      - uses: commit-check/commit-check-action@fc0543792ea1ba666c86fea9792d1d72e253ca97 # v2.1.0
        env:
          GH_TOKEN: ${{ github.token }}

commit-check.toml:

[commit]
subject_capitalized = false
subject_max_length = 72

[branch]
require_rebase_target = "origin/main"

Unfortunately, commit-check/commit-check-action doesn't report any errors when I violate the branch name, conventional commit, or imperative checks.

The commit-check tool (used as part of pre-commit) works fine, but the GitHub Action version doesn't:

...
...
...
  Type branch check failed ==> test123
  It doesn't match regex: ^(feature|bugfix|hotfix|release|chore|feat|fix)\/.+|(master)|(main)|(HEAD)|(PR-.+)
  The branch should follow Conventional Branch. See https://conventional-branch.github.io/
  Suggest: Use <type>/<description> with allowed types or ignore_authors in config branch section to bypass
...
...
...
  It doesn't match regex: ^(build|chore|ci|docs|feat|fix|perf|refactor|style|test){1}(\([\w\-\.]+\))?(!)?: ([\w ])+([\s\S]*)|(Merge).*|(fixup!.*)
  The commit message should follow Conventional Commits. See https://www.conventionalcommits.org
  Suggest: Use <type>(<scope>): <description> with allowed types

  Type imperative check failed ==> test123 message
  It doesn't match regex:
  Commit message should use imperative mood (e.g., 'Add feature' not 'Added feature')
  Suggest: Use imperative mood in the subject line

Example of the PR checked by commit-check/commit-check-action can be found here:

• test123 message ruzickap/gha-test#358
• https://github.com/ruzickap/gha-test/actions/runs/18813736947/job/53679013764?pr=358

Thank you for looking at it...

[shenxianpeng]

Hi, it looks like your .github/workflows/commit-check.yml is missing ref: ${{ github.event.pull_request.head.ref }}. for example:

name: commit-check

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions: read-all

jobs:
  commit-check:
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: ${{ github.event.pull_request.head.ref }}  # Checkout PR branch
          fetch-depth: 0

      - uses: commit-check/commit-check-action@fc0543792ea1ba666c86fea9792d1d72e253ca97 # v2.1.0
        env:
          GH_TOKEN: ${{ github.token }}

[ruzickap]

Thank you...
It works...

[ruzickap]

One more comment about the suggested solution above, which is using ref: ${{ github.event.pull_request.head.ref }}

The GitHub Security scans don't like it:

[shenxianpeng]

Thanks for sharing this. I take a look at your workflow here, it might be permissions: read-all too broad.

Since I did not encounter this issue before, could you try updating the permissions to the following and see if it resolves the problem?

jobs:
  commit-check:
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: read  # # Use least privilege instead of read-all
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          fetch-depth: 0

If this works, I’ll update the example accordingly.

[ruzickap]

Actually, the problem is not in permissions but in this line:
ref: ${{ github.event.pull_request.head.ref }}.

As mentioned above, commit-check doesn't work without the ref: line.

Example test:

jobs:
  commit-check:
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          # ref: ${{ github.event.pull_request.head.sha }}  # <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
          fetch-depth: 0

      - name: Test
        run: |
          set -x
          git rev-parse HEAD
          git log -n 5 --pretty=format:"%C(yellow)%h %Cgreen%ad %C(auto)%d %Creset%s %Cblue[%an]" --date=short

      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}  # <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
          path: checkout-pr
          fetch-depth: 0

      - name: Test
        run: |
          set -x
          cd checkout-pr
          git rev-parse HEAD
          git log -n 5 --pretty=format:"%C(yellow)%h %Cgreen%ad %C(auto)%d %Creset%s %Cblue[%an]" --date=short

In short - If I used the ref: ${{ github.event.pull_request.head.sha }} parameter I and see the output:

+ git rev-parse HEAD
9fae026884c3347288b998af3e9741365d3a2f23
+ git log -n 5 '--pretty=format:%C(yellow)%h %Cgreen%ad %C(auto)%d %Creset%s %Cblue[%an]' --date=short
9fae026 2025-11-05  (HEAD, origin/fix/commit-check) ci: enable debug mode in commit-check workflow [Petr Ruzicka]
bcb666f 2025-11-05  ci: add testing steps to commit-check workflow [Petr Ruzicka]

Without the ref: parameter I got:

+ git rev-parse HEAD
728eacefe10333279656a85baa6904899eaa0869
+ git log -n 5 '--pretty=format:%C(yellow)%h %Cgreen%ad %C(auto)%d %Creset%s %Cblue[%an]' --date=short
728eace 2025-11-05  (HEAD, pull/363/merge) Merge 9fae026884c3347288b998af3e9741365d3a2f23 into fa515931bccda079ae5d5ad3a2d9f4b9f8ad0dfb [Petr Ruzicka]
9fae026 2025-11-05  (origin/fix/commit-check) ci: enable debug mode in commit-check workflow [Petr Ruzicka]
bcb666f 2025-11-05  ci: add testing steps to commit-check workflow [Petr Ruzicka]

Example pipeline here: https://github.com/ruzickap/gha-test/actions/runs/19091991765/workflow?pr=363

-> Anyway, by default, people usually just use the actions/checkout action without specifying the ref:, like this:

      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

-> Would it be possible to adjust the commit-check to function properly without relying on the ref: parameter in actions/checkout?

[shenxianpeng]

commit-check relies on the branch name for checking the conventional branch using git branch --show-current

https://github.com/commit-check/commit-check/blob/106ea31d2c4f7bd430702c02c1dae99a4a000047/commit_check/util.py#L54

It is possible to get the branch name if the user just provides a commit hash using git branch --contains <commit>

but it will have a problem when a commit hash does not have a branch name (when the branch was merged and deleted)

[shenxianpeng]

Hi @ruzickap, thanks for the suggestion. I have support commit-check without requiring ref in actions/checkout.

Please try the latest release: commit-check/commit-check-action@v2 or commit-check/commit-check-action@v2.1.1 and let me know if any issues.