Repository navigation
feat: paged-media CSS generation for running footers #2212
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Commit author check | |
| # Fails CI when a commit's author or committer email is on a maintainer | |
| # denylist. The denylist is stored in the COMMIT_EMAIL_DENYLIST repository | |
| # secret (space-separated addresses) so no address appears in this file, | |
| # the git history, or the Actions logs. It is a denylist, not an allowlist: | |
| # external contributors commit under their own email freely. | |
| on: | |
| push: | |
| pull_request: | |
| jobs: | |
| check-commit-emails: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| with: | |
| fetch-depth: 0 | |
| - name: Reject denylisted maintainer emails on commits | |
| shell: bash | |
| env: | |
| DENYLIST: ${{ secrets.COMMIT_EMAIL_DENYLIST }} | |
| run: | | |
| set -euo pipefail | |
| if [ -z "${DENYLIST:-}" ]; then | |
| echo "COMMIT_EMAIL_DENYLIST secret not available (unset, or a fork PR) - skipping." | |
| exit 0 | |
| fi | |
| if [ "${{ github.event_name }}" = "pull_request" ]; then | |
| range="${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}" | |
| mapfile -t emails < <(git log --format='%ae%n%ce' "$range" | sed '/^$/d' | sort -u) | |
| else | |
| mapfile -t emails < <(jq -r '.commits[]? | .author.email, .committer.email' "$GITHUB_EVENT_PATH" | sed '/^$/d' | sort -u) | |
| fi | |
| fail=0 | |
| for email in "${emails[@]:-}"; do | |
| [ -z "$email" ] && continue | |
| for bad in $DENYLIST; do | |
| if [ "$email" = "$bad" ]; then | |
| fail=1 | |
| fi | |
| done | |
| done | |
| if [ "$fail" -ne 0 ]; then | |
| echo "::error::A commit carries a denylisted maintainer personal email." | |
| echo "Rewrite the offending commit(s) with the canonical noreply identity, then re-push." | |
| exit 1 | |
| fi | |
| echo "OK - no denylisted emails on commits introduced by this event." |