commit-linter.yml

---
name: Commit Linter

on:
  pull_request:
    branches:
      - main

permissions:  # added using https://github.com/step-security/secure-workflows
  contents: read

jobs:
  lint:
    permissions:
      contents: read  # for actions/checkout to fetch code
      pull-requests: read  # for wagoid/commitlint-github-action to get commits in PR
    runs-on: ubuntu-latest
    if: github.actor != 'renovate[bot]'
    steps:
      - name: Harden Runner
        uses: step-security/harden-runner@cb605e52c26070c328afc4562f0b4ada7618a84e # v2.10.4
        with:
          egress-policy: block
          allowed-endpoints: >
            api.github.com:443
            github.com:443
      - name: Checkout repository
        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
        with:
          fetch-depth: 0
      - name: Lint commits
        uses: wagoid/commitlint-github-action@b948419dd99f3fd78a6548d48f94e3df7f6bf3ed # v6.2.1