Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
Repository: commit-check/commit-check
Length of output: 1105
🌐 Web query:
commit-check .github workflows pr-labeler.yml main💡 Result:
The term "commit-check" in a GitHub Actions workflow typically refers to the use of the Commit Check tool [1][2], a policy engine used to validate Git commit metadata such as commit messages, branch names, and author information [1][3][4]. While users may name their workflow files anything (e.g., pr-labeler.yml) [5], the specific action provided by the Commit Check project is commonly implemented in a dedicated workflow file like.github/workflows/commit-check.yml [3][6]. To integrate Commit Check into your workflow, you can add the following step to your GitHub Actions file [3][4]: - uses: commit-check/commit-check-action@v2 with: message: true branch: true # Optional configurations author-name: false author-email: false job-summary: true pr-comments: ${{ github.event_name == 'pull_request' }} Key requirements for this action include: 1. Using actions/checkout@v5 with fetch-depth: 0 to ensure the full history is available for validation [3][4][6]. 2. Optionally providing a cchk.toml file in your repository root to customize policies [2][6]. If you are encountering a workflow named pr-labeler.yml that includes a commit check, it is likely a custom implementation where the developer has combined automated PR labeling with a commit validation step (often using actions/github-script or custom bash scripts) to enforce project standards [7][8][9]. Unlike the dedicated Commit Check action, these custom implementations often use regex patterns or API calls to validate commit titles directly within the PR workflow [7][8].
Citations:
🌐 Web query:
site:github.com/commit-check/.github .github/workflows/pr-labeler.yml💡 Result:
The file path.github/workflows/pr-labeler.yml is a common convention for a GitHub Actions workflow file designed to automatically label pull requests. While the specific file name is user-defined, it typically leverages the official actions/labeler GitHub Action to categorize pull requests based on the files they modify. To implement this functionality, you generally need two components: 1. A workflow file (e.g.,.github/workflows/pr-labeler.yml) that triggers on pull request events. 2. A configuration file (often located at.github/labeler.yml) that defines the rules for which files should trigger which labels. Example configuration for.github/workflows/pr-labeler.yml: name: Pull Request Labeler on: pull_request_target: types: [opened, synchronize, reopened] jobs: label: runs-on: ubuntu-latest permissions: contents: read pull-requests: write steps: - uses: actions/labeler@v5 with: repo-token: ${{ secrets.GITHUB_TOKEN }} The corresponding.github/labeler.yml file would map patterns to labels, such as: documentation: - docs/ - README.md frontend: - src/ui/ The provided search results did not contain specific implementation details for this file path within the referenced repositories.
Citations:
🏁 Script executed:
Repository: commit-check/commit-check
Length of output: 621
Pin the privileged reusable workflow to an immutable commit SHA.
pull_request_targetgrantspull-requests: writeto the reusable workflow at@main, so that mutable branch can receive write access if changed. Pinpr-labeler.ymlto an audited full-length commit SHA and ensure it does not check out or execute fork code.🤖 Prompt for AI Agents