feat: add max-header-length for header length check

- disable default header length check
- update dependency actions version
- add release details on contributing file

Author: aj3sh

.github/workflows/ci.yaml

@@ -2,7 +2,7 @@ name: Github CI
 
 on:
   push:
-    branches: ['main']
+    branches: ["main"]
   pull_request:
 
 jobs:
@@ -11,13 +11,13 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python-version: ['3.10']
+        python-version: ["3.10"]
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@v6
         with:
           python-version: ${{ matrix.python-version }}
 
@@ -38,7 +38,7 @@ jobs:
           poetry run pytest --cov=src/ --cov-report=xml --no-cov-on-fail
 
       - name: Send coverage to CodeCov
-        uses: codecov/codecov-action@v3
+        uses: codecov/codecov-action@v5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           fail_ci_if_error: false

.github/workflows/commitlint.yaml .github/workflows/commitlint.yml.github/workflows/commitlint.yaml renamed to .github/workflows/commitlint.yml

@@ -2,15 +2,15 @@ name: Commitlint
 
 on:
   push:
-    branches: ['main']
+    branches: ["main"]
   pull_request:
 
 jobs:
   commitlint:
     runs-on: ubuntu-latest
     name: Commitlint
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Run commitlint
         # uses: opensource-nepal/commitlint@v1

.github/workflows/release-please.yml

@@ -1,23 +1,25 @@
 on:
   push:
-    branches: ['main']
+    branches: ["main"]
 
 name: release-please
 
 jobs:
   release-please:
     runs-on: ubuntu-latest
     permissions:
+      # This job has the highest privileges, so always pin actions to a specific commit hash.
+      # Ensure the referenced commit hash is verified and free from known vulnerabilities.
       id-token: write # for PYPI release
       contents: write
       pull-requests: write
 
     steps:
       - name: Release
         id: release
-        uses: googleapis/release-please-action@7987652d64b4581673a76e33ad5e98e3dd56832f # v4.1.3
+        uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         if: ${{ steps.release.outputs.release_created }}
 
       - name: tag major and minor versions
@@ -32,10 +34,10 @@ jobs:
           git push origin v${{ steps.release.outputs.major }} -f
 
       - name: Set up Python
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         if: ${{ steps.release.outputs.release_created }}
         with:
-          python-version: '3.x'
+          python-version: "3.10"
 
       - name: Install dependencies
         if: ${{ steps.release.outputs.release_created }}

CONTRIBUTING.md

@@ -95,6 +95,17 @@ We welcome and appreciate pull requests from the community. To contribute:
 
    - Participate in the code review process and address any feedback promptly.
 
+## Release
+
+The release process, changelog, and versioning are managed by
+[release-please](https://github.com/googleapis/release-please). Versions are automatically
+determined based on Conventional Commit types, and the changelog is generated from commit
+messages.
+
+The [release-please-action](https://github.com/googleapis/release-please-action) creates
+a release PR ([example PR](https://github.com/opensource-nepal/commitlint/pull/62)) for
+bug fixes and features. A new release is published only after the release PR is merged.
+
 ## License
 
 By contributing to this project, you agree that your contributions will be licensed under the **GPL-3.0 License**.

README.md

@@ -25,7 +25,7 @@ steps:
     ...
 ```
 
-If you don't have any workflows, create a new GitHub workflow file, e.g., `.github/workflows/commitlint.yaml`:
+If you don't have any workflows, create a new GitHub workflow file, e.g., `.github/workflows/commitlint.yml`:
 
 ```yaml
 name: Conventional Commitlint
@@ -70,11 +70,12 @@ Github API failed with status code 403. Response: {'message': 'Resource not acce
 
 #### GitHub Action Inputs
 
-| #   | Name              | Type    | Default                | Description                                                           |
-| --- | ----------------- | ------- | ---------------------- | --------------------------------------------------------------------- |
-| 1   | **fail_on_error** | Boolean | `true`                 | Whether the GitHub Action should fail if commitlint detects an issue. |
-| 2   | **verbose**       | Boolean | `false`                | Enables verbose output.                                               |
-| 3   | **token**         | String  | `secrets.GITHUB_TOKEN` | GitHub Token for fetching commits using the GitHub API.               |
+| #   | Name                  | Type    | Default                | Description                                                                                   |
+| --- | --------------------- | ------- | ---------------------- | --------------------------------------------------------------------------------------------- |
+| 1   | **fail_on_error**     | Boolean | `true`                 | Whether the GitHub Action should fail if commitlint detects an issue.                         |
+| 2   | **verbose**           | Boolean | `false`                | Enables verbose output.                                                                       |
+| 3   | **max_header_length** | Number  |                        | Optional. Maximum header length to check. If not specified, the header length is not checked. |
+| 4   | **token**             | String  | `secrets.GITHUB_TOKEN` | GitHub Token for fetching commits using the GitHub API.                                       |
 
 #### GitHub Action Outputs
 

action.yml

@@ -1,14 +1,17 @@
-name: 'Conventional Commitlint'
-description: 'A GitHub Action to check conventional commit message'
+name: "Conventional Commitlint"
+description: "A GitHub Action to check conventional commit message"
 
 inputs:
   fail_on_error:
     description: Whether to fail the workflow if commit messages don't follow conventions.
-    default: 'true'
+    default: "true"
     required: false
   verbose:
     description: Verbose output.
-    default: 'false'
+    default: "false"
+    required: false
+  max_header_length:
+    description: "Maximum header length to check. If not specified, the header length is not checked."
     required: false
   token:
     description: Token for fetching commits using Github API.
@@ -24,16 +27,18 @@ outputs:
     value: ${{ steps.commitlint.outputs.exit_code }}
 
 branding:
-  color: 'red'
-  icon: 'git-commit'
+  color: "red"
+  icon: "git-commit"
 
 runs:
-  using: 'composite'
+  using: "composite"
   steps:
     - name: Install Python
-      uses: actions/setup-python@v5.1.0
+      # Use a specific version for action dependencies
+      # A commitlint action version should use fixed dependency versions (not mutable versions)
+      uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
       with:
-        python-version: '3.10'
+        python-version: "3.10"
 
     - name: Commitlint Action
       id: commitlint
@@ -46,3 +51,4 @@ runs:
         INPUT_TOKEN: ${{ inputs.token }}
         INPUT_FAIL_ON_ERROR: ${{ inputs.fail_on_error }}
         INPUT_VERBOSE: ${{ inputs.verbose }}
+        INPUT_MAX_HEADER_LENGTH: ${{ inputs.max_header_length }}

docs/cli.md

@@ -9,26 +9,29 @@ pip install commitlint
 ## Usage
 
 ```
-commitlint [-h] [-V] [--file FILE] [--hash HASH] [--from-hash FROM_HASH] [--to-hash TO_HASH] [--skip-detail] [--hide-input]
+commitlint [-h] [-V] [--file FILE] [--hash HASH] [--from-hash FROM_HASH] [--to-hash TO_HASH]
+           [--skip-detail] [--hide-input]
            [-q | -v]
+           [--max-header-length MAX_HEADER_LENGTH]
            [commit_message]
 
 Check if a commit message follows the Conventional Commits format.
 
 Positional arguments:
-  commit_message        The commit message to be checked.
+  commit_message                The commit message to be checked.
 
 Options:
-  -h, --help            Show this help message and exit.
-  -V, --version         Show the program's version number and exit.
-  --file FILE           Path to a file containing the commit message.
-  --hash HASH           Commit hash.
-  --from-hash FROM_HASH Commit hash to start checking from.
-  --to-hash TO_HASH     Commit hash to check up to.
-  --skip-detail         Skip detailed error messages.
-  --hide-input          Hide input from stdout.
-  -q, --quiet           Suppress stdout and stderr.
-  -v, --verbose         Enable verbose output.
+  -h, --help                    Show this help message and exit.
+  --file FILE                   Path to a file containing the commit message.
+  -V, --version                 Show the program's version number and exit.
+  --hash HASH                   Commit hash.
+  --from-hash FROM_HASH         Commit hash to start checking from.
+  --to-hash TO_HASH             Commit hash to check up to.
+  --skip-detail                 Skip detailed error messages.
+  --hide-input                  Hide input from stdout.
+  -q, --quiet                   Suppress stdout and stderr.
+  -v, --verbose                 Enable verbose output.
+  --max-header-length LENGTH    Maximum header length to check.
 ```
 
 ## Examples
@@ -79,6 +82,12 @@ Run `commitlint` in verbose mode:
 $ commitlint --verbose "chore: my commit message"
 ```
 
+Run `commitlint` with maximum header length check:
+
+```shell
+$ commitlint --max-header-length 72 "chore: my commit message"
+```
+
 Check the version:
 
 ```shell

docs/conventional-commits.md

@@ -22,5 +22,3 @@ E.g., `feat(parser): add JSON parser`.
 **Body:** A detailed description of the commit.
 
 For more details, please refer to the Conventional Commits specification at https://www.conventionalcommits.org/en/v1.0.0/
-
-> NOTE: commitlint also checks the length of the commit header (**max 72 characters**). The commit header refers to the first line of the commit message (excluding the body).

github_actions/action/run.py

@@ -12,6 +12,7 @@
 from .utils import (
     get_boolean_input,
     get_input,
+    get_positive_int_input,
     request_github_api,
     write_line_to_file,
     write_output,
@@ -26,6 +27,7 @@
 INPUT_TOKEN = "token"
 INPUT_FAIL_ON_ERROR = "fail_on_error"
 INPUT_VERBOSE = "verbose"
+INPUT_MAX_HEADER_LENGTH = "max_header_length"
 
 # Status
 STATUS_SUCCESS = "success"
@@ -115,6 +117,10 @@ def run_commitlint(commit_message: str) -> Tuple[bool, Optional[str]]:
         if verbose:
             commands.append("--verbose")
 
+        max_header_length = get_positive_int_input(INPUT_MAX_HEADER_LENGTH)
+        if max_header_length is not None:
+            commands.extend(["--max-header-length", str(max_header_length)])
+
         output = subprocess.check_output(commands, text=True, stderr=subprocess.PIPE)
         if output:
             sys.stdout.write(f"{output}")

github_actions/action/utils.py

@@ -56,6 +56,52 @@ def get_boolean_input(key: str) -> bool:
     )
 
 
+def get_int_input(key: str) -> int | None:
+    """
+    Read the GitHub action integer input.
+
+    Args:
+        key: Input key.
+
+    Returns:
+        The integer value of the input. If not integer, returns None
+
+    Raises:
+        ValueError: If the value is a non-empty, non-integer string.
+    """
+    val = get_input(key)
+
+    if val == "":
+        # GitHub Action passes empty data as a empty string ("")
+        return None
+
+    try:
+        return int(val)
+    except ValueError:
+        raise ValueError(f"Input '{key}' must be a valid integer.") from None
+
+
+def get_positive_int_input(key: str) -> int | None:
+    """
+    Read the GitHub action integer input.
+
+    Args:
+        key: Input key.
+
+    Returns:
+        The integer value of the input. If not integer, returns None
+
+    Raises:
+        ValueError: If the value is a non-empty, non-integer string.
+    """
+    int_val = get_int_input(key)
+
+    if int_val is not None and int_val <= 0:
+        raise ValueError(f"Input '{key}' must be a positive integer.")
+
+    return int_val
+
+
 def write_line_to_file(filepath: str, line: str) -> None:
     """
     Write line to a specified filepath.