feat: upgrade to commitlint v21 on node 24

.github/workflows/ci.yml

@@ -1,18 +1,22 @@
 name: CI
 on: [push]
 
+permissions: {}
+
 jobs:
   sanity-checks:
     permissions:
       contents: read
     name: Sanity Checks
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20.16.0'
-      - uses: actions/cache@v3
+          node-version: '24.19.0'
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ~/.npm
@@ -23,66 +27,19 @@ jobs:
       - run: npm ci --ignore-scripts
       - run: npm run lint
       - run: npm test -- --ci --coverage
-  release:
+
+  # Upstream's release job ran commit-and-tag-version and pushed to Docker Hub
+  # using DOCKER_USERNAME/DOCKER_TOKEN. This fork publishes to ghcr.io from a
+  # pushed tag instead — see .github/workflows/publish-image.yml.
+
+  image-builds:
     permissions:
-      contents: write
+      contents: read
     needs: sanity-checks
+    name: Image builds
     runs-on: ubuntu-latest
-    if: >
-      github.ref == 'refs/heads/master'
-      && !contains(toJSON(github.event.commits.*.message), '[skip-ci]')
-      && !contains(toJSON(github.event.commits.*.message), 'chore(deps-dev)')
-    env:
-      DOCKER_REGISTRY_URL: registry.hub.docker.com
     steps:
-      - uses: actions/checkout@v3
-        with:
-          fetch-depth: 0
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20.16.0'
-      - uses: actions/cache@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
-          path: |
-            ~/.npm
-            **/node_modules
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
-      - run: npm ci --ignore-scripts
-      - name: Configure git user
-        run: |
-          git config user.email 'github-action@users.noreply.github.com'
-          git config user.name 'GitHub Action'
-      - name: Update versions and changelog
-        run: |
-          # remove `"type": "module"` from package.json since `commit-and-tag-version` doesn't support it
-          sed -i '/"type": "module",/c\' package.json
-          npx commit-and-tag-version
-          # bring back `"type": "module"`
-          sed -i 's/"private": true,/"private": true,\n  "type": "module",/' package.json
-          git commit --amend --no-edit
-      - name: Set VERSION env var
-        run: |
-          version=`node -p "require('./package.json').version"`
-          echo "VERSION=$version" >> $GITHUB_ENV
-      - name: Login to docker registry
-        env:
-          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
-          DOCKER_TOKEN: ${{ secrets.DOCKER_TOKEN }}
-        run: docker login -u $DOCKER_USERNAME -p $DOCKER_TOKEN $DOCKER_REGISTRY_URL
-      - name: Build image
-        run: |
-          docker build -t $DOCKER_REGISTRY_URL/wagoid/commitlint-github-action:$VERSION .
-      - name: Push to docker registry
-        run: |
-          docker push $DOCKER_REGISTRY_URL/wagoid/commitlint-github-action:$VERSION
-      - run: git push --atomic --follow-tags origin master
-      - name: Create a git tag for the major version
-        run: |
-          major=`echo $VERSION | sed -E 's/([0-9]+)(.+)/\1/'`
-          version_name="v$major"
-          tag_heading="This version points to the latest version available (v$VERSION)."
-          tag_body="This is necessary because currently Github Actions don't apply any semantic versioning matching when downloading versions."
-          git tag -fa "$version_name" -m "$version_name" -m "$tag_heading" -m "$tag_body"
-          git push -f origin "$version_name"
+          persist-credentials: false
+      - run: docker build -t commitlint-github-action:ci .

.github/workflows/commitlint.yml

@@ -1,17 +1,26 @@
 name: Commitlint
 on: [push, pull_request]
 
+permissions: {}
+
 jobs:
   commitlint:
+    permissions:
+      contents: read
+      pull-requests: read
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+      # Point action.yml at the local Dockerfile so this runs the code in the
+      # branch rather than a previously published image.
       - run: sed -i -E "s/(docker:.+)/Dockerfile/" ./action.yml
       - run: echo -n '' > .dockerignore
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
-          node-version: '20.16.0'
-      - uses: actions/cache@v3
+          node-version: '24.19.0'
+      - uses: actions/cache@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
         with:
           path: |
             ~/.npm
@@ -26,23 +35,12 @@ jobs:
           NODE_PATH: ${{ github.workspace }}/node_modules
       - name: Show results from JSON output
         if: ${{ always() }}
-        run: echo ${{ toJSON(steps.run_commitlint.outputs.results) }}
-  commitlint-pulling-from-docker-hub:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-node@v4
-        with:
-          node-version: '20.16.0'
-      - uses: actions/cache@v3
-        with:
-          path: |
-            ~/.npm
-            **/node_modules
-          key: ${{ runner.os }}-node-${{ hashFiles('**/package-lock.json') }}
-          restore-keys: |
-            ${{ runner.os }}-node-
-      - run: npm ci --ignore-scripts
-      - uses: ./
         env:
-          NODE_PATH: ${{ github.workspace }}/node_modules
+          RESULTS: ${{ toJSON(steps.run_commitlint.outputs.results) }}
+        run: echo "$RESULTS"
+
+  # Upstream also had a `commitlint-pulling-from-docker-hub` job that ran the
+  # action without rewriting action.yml, so it pulled whichever tag action.yml
+  # named. That can only pass once the image for that version is published, so
+  # it fails on every PR that bumps the version. The published image is smoke
+  # tested in publish-image.yml instead, where it exists.

.github/workflows/publish-image.yml

@@ -0,0 +1,64 @@
+name: Publish image
+
+# Upstream released via commit-and-tag-version and pushed to Docker Hub with
+# secrets this fork does not have. Here the tag is the trigger: push v6.3.0 and
+# this builds ghcr.io/yo61/commitlint-github-action:6.3.0, which action.yml
+# refers to.
+
+on:
+  push:
+    tags: ['v*']
+
+permissions: {}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Derive version from tag
+        env:
+          REF_NAME: ${{ github.ref_name }}
+        run: |
+          set -euo pipefail
+          version="${REF_NAME#v}"
+          echo "VERSION=$version" >> "$GITHUB_ENV"
+          echo "MAJOR=${version%%.*}" >> "$GITHUB_ENV"
+
+      - name: Log in to ghcr.io
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          ACTOR: ${{ github.actor }}
+        run: |
+          set -euo pipefail
+          echo "$GH_TOKEN" | docker login ghcr.io -u "$ACTOR" --password-stdin
+
+      - name: Build and push
+        env:
+          IMAGE: ghcr.io/${{ github.repository_owner }}/commitlint-github-action
+        run: |
+          set -euo pipefail
+          docker build -t "$IMAGE:$VERSION" -t "$IMAGE:$MAJOR" .
+          docker push "$IMAGE:$VERSION"
+          docker push "$IMAGE:$MAJOR"
+
+      # Confirms the tag action.yml refers to is pullable and runnable. Pulling
+      # from a clean local cache proves it came from the registry rather than
+      # the layer just built.
+      - name: Smoke test the published image
+        env:
+          IMAGE: ghcr.io/${{ github.repository_owner }}/commitlint-github-action
+        run: |
+          set -euo pipefail
+          docker image rm -f "$IMAGE:$VERSION" "$IMAGE:$MAJOR"
+          docker pull "$IMAGE:$VERSION"
+          node_version=$(docker run --rm --entrypoint node "$IMAGE:$VERSION" --version)
+          echo "published image runs node $node_version"
+          docker run --rm --entrypoint node "$IMAGE:$VERSION" \
+            -e 'console.log("commitlint " + require("/node_modules/@commitlint/lint/package.json").version)'

.nvmrc

@@ -1 +1 @@
-20.16.0
+24.19.0

Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20.16.0-alpine3.20 as build
+FROM node:24.19.0-alpine3.24 AS build
 
 COPY package*.json /
 
@@ -8,7 +8,7 @@ COPY . .
 
 RUN npm run build
 
-FROM node:20.16.0-alpine3.20
+FROM node:24.19.0-alpine3.24
 
 RUN apk --no-cache add git
 

action.yml

@@ -3,25 +3,26 @@ description: Lints Pull Request commit messages with commitlint
 author: Wagner Santos
 inputs:
   configFile:
-    description: Commitlint config file. If the file doesn't exist, config-conventional settings will be
+    description:
+      Commitlint config file. If the file doesn't exist, config-conventional settings will be
       loaded as a fallback.
     default: ./commitlint.config.mjs
     required: false
   failOnWarnings:
     description: Whether you want to fail on warnings or not
-    default: "false"
+    default: 'false'
     required: false
   failOnErrors:
     description: Whether you want to fail on errors or not
-    default: "true"
+    default: 'true'
     required: true
   helpURL:
     description: Link to a page explaining your commit message convention
     default: https://github.com/conventional-changelog/commitlint/#what-is-commitlint
     required: false
   commitDepth:
     description: When set to a valid Integer value - X, considers only the latest X number of commits.
-    default: ""
+    default: ''
     required: false
   token:
     description: >
@@ -35,7 +36,7 @@ outputs:
     description: The error and warning messages for each one of the analyzed commits
 runs:
   using: docker
-  image: docker://wagoid/commitlint-github-action:6.2.1
+  image: docker://ghcr.io/yo61/commitlint-github-action:6.3.0
 branding:
   icon: check-square
   color: blue