commit-check-action fails to halt pipeline when validation rules are violated

I'm using a simple GitHub Actions workflow and a minimal commit-check.toml configuration since most defaults work well:

.github/workflows/commit-check.yml:

name: commit-check

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions: read-all

jobs:
  commit-check:
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

      - uses: commit-check/commit-check-action@fc0543792ea1ba666c86fea9792d1d72e253ca97 # v2.1.0
        env:
          GH_TOKEN: ${{ github.token }}

commit-check.toml:

[commit]
subject_capitalized = false
subject_max_length = 72

[branch]
require_rebase_target = "origin/main"

Unfortunately, commit-check/commit-check-action doesn't report any errors when I violate the branch name, conventional commit, or imperative checks.

The commit-check tool (used as part of pre-commit) works fine, but the GitHub Action version doesn't:

...
...
...
  Type branch check failed ==> test123
  It doesn't match regex: ^(feature|bugfix|hotfix|release|chore|feat|fix)\/.+|(master)|(main)|(HEAD)|(PR-.+)
  The branch should follow Conventional Branch. See https://conventional-branch.github.io/
  Suggest: Use <type>/<description> with allowed types or ignore_authors in config branch section to bypass
...
...
...
  It doesn't match regex: ^(build|chore|ci|docs|feat|fix|perf|refactor|style|test){1}(\([\w\-\.]+\))?(!)?: ([\w ])+([\s\S]*)|(Merge).*|(fixup!.*)
  The commit message should follow Conventional Commits. See https://www.conventionalcommits.org
  Suggest: Use <type>(<scope>): <description> with allowed types

  Type imperative check failed ==> test123 message
  It doesn't match regex:
  Commit message should use imperative mood (e.g., 'Add feature' not 'Added feature')
  Suggest: Use imperative mood in the subject line

Example of the PR checked by commit-check/commit-check-action can be found here:

Thank you for looking at it...

Hi, it looks like your .github/workflows/commit-check.yml is missing ref: ${{ github.event.pull_request.head.ref }}. for example:

name: commit-check

on:
  pull_request:
    branches:
      - main
  workflow_dispatch:

permissions: read-all

jobs:
  commit-check:
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: ${{ github.event.pull_request.head.ref }}  # Checkout PR branch
          fetch-depth: 0

      - uses: commit-check/commit-check-action@fc0543792ea1ba666c86fea9792d1d72e253ca97 # v2.1.0
        env:
          GH_TOKEN: ${{ github.token }}

Thank you...
It works...

One more comment about the suggested solution above, which is using ref: ${{ github.event.pull_request.head.ref }}

The GitHub Security scans don't like it:

Thanks for sharing this. I take a look at your workflow here, it might be permissions: read-all too broad.

Since I did not encounter this issue before, could you try updating the permissions to the following and see if it resolves the problem?

jobs:
  commit-check:
    runs-on: ubuntu-24.04-arm
    permissions:
      contents: read  # # Use least privilege instead of read-all
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: ${{ github.event.pull_request.head.ref }}
          fetch-depth: 0

If this works, I’ll update the example accordingly.

Actually, the problem is not in permissions but in this line:
ref: ${{ github.event.pull_request.head.ref }}.

As mentioned above, commit-check doesn't work without the ref: line.

Example test:

jobs:
  commit-check:
    runs-on: ubuntu-24.04-arm
    steps:
      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          # ref: ${{ github.event.pull_request.head.sha }}  # <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
          fetch-depth: 0

      - name: Test
        run: |
          set -x
          git rev-parse HEAD
          git log -n 5 --pretty=format:"%C(yellow)%h %Cgreen%ad %C(auto)%d %Creset%s %Cblue[%an]" --date=short

      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          ref: ${{ github.event.pull_request.head.sha }}  # <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<
          path: checkout-pr
          fetch-depth: 0

      - name: Test
        run: |
          set -x
          cd checkout-pr
          git rev-parse HEAD
          git log -n 5 --pretty=format:"%C(yellow)%h %Cgreen%ad %C(auto)%d %Creset%s %Cblue[%an]" --date=short

In short - If I used the ref: ${{ github.event.pull_request.head.sha }} parameter I and see the output:

+ git rev-parse HEAD
9fae026884c3347288b998af3e9741365d3a2f23
+ git log -n 5 '--pretty=format:%C(yellow)%h %Cgreen%ad %C(auto)%d %Creset%s %Cblue[%an]' --date=short
9fae026 2025-11-05  (HEAD, origin/fix/commit-check) ci: enable debug mode in commit-check workflow [Petr Ruzicka]
bcb666f 2025-11-05  ci: add testing steps to commit-check workflow [Petr Ruzicka]

Without the ref: parameter I got:

+ git rev-parse HEAD
728eacefe10333279656a85baa6904899eaa0869
+ git log -n 5 '--pretty=format:%C(yellow)%h %Cgreen%ad %C(auto)%d %Creset%s %Cblue[%an]' --date=short
728eace 2025-11-05  (HEAD, pull/363/merge) Merge 9fae026884c3347288b998af3e9741365d3a2f23 into fa515931bccda079ae5d5ad3a2d9f4b9f8ad0dfb [Petr Ruzicka]
9fae026 2025-11-05  (origin/fix/commit-check) ci: enable debug mode in commit-check workflow [Petr Ruzicka]
bcb666f 2025-11-05  ci: add testing steps to commit-check workflow [Petr Ruzicka]

Example pipeline here: https://github.com/ruzickap/gha-test/actions/runs/19091991765/workflow?pr=363

-> Anyway, by default, people usually just use the actions/checkout action without specifying the ref:, like this:

      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
        with:
          fetch-depth: 0

-> Would it be possible to adjust the commit-check to function properly without relying on the ref: parameter in actions/checkout?

commit-check relies on the branch name for checking the conventional branch using git branch --show-current

https://github.com/commit-check/commit-check/blob/106ea31d2c4f7bd430702c02c1dae99a4a000047/commit_check/util.py#L54

It is possible to get the branch name ~~if the user just provides a commit hash using git branch --contains <commit>~~

~~but it will have a problem when a commit hash does not have a branch name (when the branch was merged and deleted)~~

@ruzickap

Hi @ruzickap, thanks for the suggestion. I have support commit-check without requiring ref in actions/checkout.

Please try the latest release: commit-check/commit-check-action@v2 or commit-check/commit-check-action@v2.1.1 and let me know if any issues.

Thank you...

Now it is working fine... :-)

Navigation Menu

Repository navigation

commit-check-action fails to halt pipeline when validation rules are violated #156

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

commit-check-action fails to halt pipeline when validation rules are violated #156

Description

Activity

shenxianpeng commented on Oct 26, 2025

ruzickap commented on Oct 26, 2025

ruzickap commented on Oct 30, 2025

shenxianpeng commented on Oct 30, 2025

ruzickap commented on Nov 5, 2025

shenxianpeng commented on Nov 5, 2025

shenxianpeng commented on Nov 5, 2025

ruzickap commented on Nov 6, 2025

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions