tools: lint PR commit messages without approval

[panva]

This lets first time contributor PRs know their commit message is invalid without a collaborator having to step in and approve the GHA workflow runs and without checking out the fork code.

Use pull_request_target to run commit message linting without fork workflow approval. Fetch the first commit through the API and pass its message to a pinned validator as JSON on stdin.

Capture validator output and report failures through escaped annotations, using only read access to pull requests.

[nodejs-github-bot]

Review requested:

• @nodejs/actions

[panva]

tested:

nodejs/node-auto-test#105
https://github.com/nodejs/node-auto-test/actions/runs/34109416123/job/101701927124?pr=105

[MikeMcC399]

RSLGTM!

I agree very much with the goal of linting the commit message(s) without approval. The new comment text to first-time contributors already reminds about the need for a Signed-off-by trailer, and this PR means they don't have to wait to get checked.

[aduh95]

I think this would work and be more maintainable

Suggested change

	uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
	with:
	script: |
	const { data: [commit] } = await github.rest.pulls.listCommits({
	...context.repo,
	pull_number: context.issue.number,
	per_page: 1,
	});
	if (!commit) {
	throw new Error('No commits found in pull request');
	}
	const { exitCode, stdout, stderr } = await exec.getExecOutput('npx', [
	'-q', '--yes', '--ignore-scripts', 'core-validate-commit@6.0.0',
	'--no-validate-metadata', '--tap', '-',
	], {
	cwd: process.env.RUNNER_TEMP,
	input: Buffer.from(JSON.stringify([{ id: commit.sha, message: commit.commit.message }])),
	silent: true,
	ignoreReturnCode: true,
	});
	if (exitCode !== 0) {
	core.setFailed(stdout + stderr || 'Commit message validation failed');
	} else {
	core.info('First commit message passes validation');
	}
	run: echo "$COMMITS" | npx -q core-validate-commit -
	env:
	COMMITS: ${{ toJSON([github.event.commits[0]]) }}

[panva]

Wouldn't work. github.event.commits is an integer count for pull_request_target, not the individual commits, and array index literals don't work in expressions either. I also wanted to avoid streaming linter output to avoid workflow-command injection since we're on pull_request_target.