git-commit-guard 0.20.0__tar.gz → 0.20.1__tar.gz

{git_commit_guard-0.20.0 → git_commit_guard-0.20.1}/.github/workflows/coverage-baseline.yml

@@ -19,7 +19,7 @@ jobs:
         uses: astral-sh/setup-uv@37802adc94f370d6bfd71619e3f0bf239e1f3b78  # ratchet:astral-sh/setup-uv@v7
       - name: Cache NLTK data
         # yamllint disable-line rule:line-length
-        uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae  # ratchet:actions/cache@v5
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7  # v5.0.4
         with:
           path: ~/nltk_data
           key: nltk-averaged-perceptron-tagger-punkt

{git_commit_guard-0.20.0 → git_commit_guard-0.20.1}/.github/workflows/lint-commits.yml

@@ -22,7 +22,6 @@ jobs:
           key: nltk-averaged-perceptron-tagger-punkt
       - name: Lint commits
         # yamllint disable-line rule:line-length
-        uses: benner/commit-guard@7704c563540b24bb10394e373e508dc664a7f01f  # v0.19.0
+        uses: benner/commit-guard@cab0d35c41a3f99fc5f61895f491d0ce3f5aff1c  # v0.20.0
         with:
           range: origin/${{ github.base_ref }}..HEAD
-          disable: signature

{git_commit_guard-0.20.0 → git_commit_guard-0.20.1}/.github/workflows/lint-md.yml

@@ -23,4 +23,4 @@ jobs:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           reporter: github-pr-review
           level: info
-          fail_on_error: true
+          fail_level: any

{git_commit_guard-0.20.0 → git_commit_guard-0.20.1}/.github/workflows/lint-workflows.yml

@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Checkout code
         # yamllint disable-line rule:line-length
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # ratchet:actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
       - name: Run actionlint
@@ -21,6 +21,7 @@ jobs:
         with:
           github_token: ${{ github.token }}
           reporter: github-pr-review
+          fail_level: any
   yamlfix:
     runs-on: ubuntu-latest
     permissions:
@@ -28,7 +29,7 @@ jobs:
     steps:
       - name: Checkout code
         # yamllint disable-line rule:line-length
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # ratchet:actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
       - name: Set up uv
@@ -41,10 +42,11 @@ jobs:
         env:
           REVIEWDOG_GITHUB_API_TOKEN: ${{ github.token }}
         run: |-
+          set -o pipefail
           uvx yamlfix .github/workflows/
           git diff .github/workflows/ |
             reviewdog -f=diff -name=yamlfix \
-              -reporter=github-pr-review -fail-on-error
+              -reporter=github-pr-review -fail-level=any
   zizmor:
     runs-on: ubuntu-latest
     permissions:
@@ -52,7 +54,7 @@ jobs:
     steps:
       - name: Checkout code
         # yamllint disable-line rule:line-length
-        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5  # ratchet:actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
         with:
           persist-credentials: false
       - name: Set up uv
@@ -65,6 +67,7 @@ jobs:
         env:
           REVIEWDOG_GITHUB_API_TOKEN: ${{ github.token }}
         run: |-
+          set -o pipefail
           uvx zizmor==1.24.1 --format=sarif . |
             reviewdog -f=sarif -name=zizmor \
-              -reporter=github-pr-review -fail-on-error
+              -reporter=github-pr-review -fail-level=any

{git_commit_guard-0.20.0 → git_commit_guard-0.20.1}/.github/workflows/test.yml

@@ -27,9 +27,11 @@ jobs:
             tests/ --cov=git_commit_guard --cov-report=term-missing \
             --cov-report=xml
       - name: Save coverage artifact
+        env:
+          PR_NUMBER: ${{ github.event.number }}
         run: |
           mkdir -p ./pr
-          echo ${{ github.event.number }} > ./pr/NR
+          echo "$PR_NUMBER" > ./pr/NR
           cp coverage.xml ./pr/
       - name: Upload PR artifact
         # yamllint disable-line rule:line-length

{git_commit_guard-0.20.0 → git_commit_guard-0.20.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-commit-guard
-Version: 0.20.0
+Version: 0.20.1
 Summary: Opinionated conventional commit message linter with imperative mood detection
 Project-URL: Homepage, https://github.com/benner/commit-guard
 Project-URL: Repository, https://github.com/benner/commit-guard
@@ -296,7 +296,7 @@ COMMIT_GUARD_GIT_TIMEOUT=30 commit-guard --range origin/main..HEAD
 In GitHub Actions, set it at the step or job level:
 
 ```yaml
-- uses: benner/commit-guard@v0.19.0
+- uses: benner/commit-guard@v0.20.1
   env:
     COMMIT_GUARD_GIT_TIMEOUT: 30
   with:
@@ -380,7 +380,7 @@ steps:
   - uses: actions/checkout@v4
     with:
       fetch-depth: 0
-  - uses: benner/commit-guard@v0.19.0
+  - uses: benner/commit-guard@v0.20.1
 ```
 
 Check all commits in a pull request:
@@ -396,7 +396,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.19.0
+      - uses: benner/commit-guard@v0.20.1
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
 ```
@@ -404,7 +404,7 @@ jobs:
 Check a specific commit SHA (mirrors the positional CLI argument):
 
 ```yaml
-      - uses: benner/commit-guard@v0.19.0
+      - uses: benner/commit-guard@v0.20.1
         with:
           rev: ${{ github.sha }}
 ```
@@ -422,7 +422,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.19.0
+      - uses: benner/commit-guard@v0.20.1
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
           disable: signed-off,signature
@@ -442,7 +442,7 @@ jobs:
 When `output-file` is set the action exposes the path as an output:
 
 ```yaml
-      - uses: benner/commit-guard@v0.19.0
+      - uses: benner/commit-guard@v0.20.1
         id: cg
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
@@ -458,7 +458,7 @@ Add to your `.pre-commit-config.yaml`:
 ---
 repos:
   - repo: https://github.com/benner/commit-guard
-    rev: v0.19.0
+    rev: v0.20.1
     hooks:
       - id: commit-guard
       - id: commit-guard-signature

{git_commit_guard-0.20.0 → git_commit_guard-0.20.1}/README.md

@@ -275,7 +275,7 @@ COMMIT_GUARD_GIT_TIMEOUT=30 commit-guard --range origin/main..HEAD
 In GitHub Actions, set it at the step or job level:
 
 ```yaml
-- uses: benner/commit-guard@v0.19.0
+- uses: benner/commit-guard@v0.20.1
   env:
     COMMIT_GUARD_GIT_TIMEOUT: 30
   with:
@@ -359,7 +359,7 @@ steps:
   - uses: actions/checkout@v4
     with:
       fetch-depth: 0
-  - uses: benner/commit-guard@v0.19.0
+  - uses: benner/commit-guard@v0.20.1
 ```
 
 Check all commits in a pull request:
@@ -375,7 +375,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.19.0
+      - uses: benner/commit-guard@v0.20.1
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
 ```
@@ -383,7 +383,7 @@ jobs:
 Check a specific commit SHA (mirrors the positional CLI argument):
 
 ```yaml
-      - uses: benner/commit-guard@v0.19.0
+      - uses: benner/commit-guard@v0.20.1
         with:
           rev: ${{ github.sha }}
 ```
@@ -401,7 +401,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.19.0
+      - uses: benner/commit-guard@v0.20.1
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
           disable: signed-off,signature
@@ -421,7 +421,7 @@ jobs:
 When `output-file` is set the action exposes the path as an output:
 
 ```yaml
-      - uses: benner/commit-guard@v0.19.0
+      - uses: benner/commit-guard@v0.20.1
         id: cg
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
@@ -437,7 +437,7 @@ Add to your `.pre-commit-config.yaml`:
 ---
 repos:
   - repo: https://github.com/benner/commit-guard
-    rev: v0.19.0
+    rev: v0.20.1
     hooks:
       - id: commit-guard
       - id: commit-guard-signature

{git_commit_guard-0.20.0 → git_commit_guard-0.20.1}/docs/index.html

@@ -538,13 +538,13 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.19.0
+      - uses: benner/commit-guard@v0.20.1
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
           disable: signed-off,signature</code></pre>
 
         <p>Check a specific commit SHA:</p>
-        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.19.0
+        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.20.1
         with:
           rev: ${{ github.sha }}</code></pre>
 
@@ -563,7 +563,7 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
           When <code>output-file</code> is set the action exposes the path as
           a step output, making JSONL results available to subsequent steps:
         </p>
-        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.19.0
+        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.20.1
         id: cg
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
@@ -576,7 +576,7 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
         <p>Add to <code>.pre-commit-config.yaml</code>:</p>
         <pre><code class="language-yaml">repos:
   - repo: https://github.com/benner/commit-guard
-    rev: v0.19.0
+    rev: v0.20.1
     hooks:
       - id: commit-guard
       - id: commit-guard-signature</code></pre>

{git_commit_guard-0.20.0 → git_commit_guard-0.20.1}/src/git_commit_guard/__init__.py

@@ -78,7 +78,10 @@ def _load_config(start=None):
         config_path = directory / ".commit-guard.toml"
         if config_path.exists():
             with config_path.open("rb") as f:
-                return tomllib.load(f)
+                try:
+                    return tomllib.load(f)
+                except tomllib.TOMLDecodeError as e:
+                    sys.exit(f"{config_path}: {e}")
     return {}
 
 
@@ -411,6 +414,11 @@ def check_signature(rev, result):
             result.info("signature type: SSH", check=Check.SIGNATURE)
             return
         result.error("commit is not signed (GPG/SSH)", check=Check.SIGNATURE)
+    except subprocess.TimeoutExpired:
+        result.error(
+            "git operation timed out — cannot verify signature",
+            check=Check.SIGNATURE,
+        )
     except (urllib.error.URLError, TimeoutError):
         result.error(
             "GitHub API unreachable — cannot verify signature",
@@ -698,7 +706,7 @@ def _parse_args():  # noqa: PLR0915 Too many statements (59 > 50)
         message = ""
     elif args.message_file:
         rev = None
-        message = _strip_comments(args.message_file.read_text().strip())
+        message = _strip_comments(args.message_file.read_text(encoding="utf-8").strip())
     elif args.rev:
         rev = args.rev
         message = _strip_comments(_get_message(rev))

{git_commit_guard-0.20.0 → git_commit_guard-0.20.1}/tests/test_git_commit_guard.py

@@ -833,6 +833,16 @@ class TestCheckSignature:
         assert not r.ok
         assert any("API unreachable" in msg for _, _, msg in r.errors)
 
+    def test_subprocess_timeout_fails_gracefully(self):
+        r = Result()
+        with patch(
+            "git_commit_guard._get_author_email",
+            side_effect=subprocess.TimeoutExpired(cmd="git", timeout=10),
+        ):
+            check_signature("abc123", r)
+        assert not r.ok
+        assert any("git operation timed out" in msg for _, _, msg in r.errors)
+
     def test_commits_api_resolves_username(self):
         r = Result()
         with (
@@ -1007,6 +1017,12 @@ class TestLoadConfig:
         (subdir / ".commit-guard.toml").write_text('disable = ["signature"]\n')
         assert _load_config(subdir) == {"disable": ["signature"]}
 
+    def test_malformed_toml_exits_with_path(self, tmp_path):
+        config_path = tmp_path / ".commit-guard.toml"
+        config_path.write_text("disable = [unclosed\n")
+        with pytest.raises(SystemExit, match=re.escape(str(config_path))):
+            _load_config(tmp_path)
+
 
 class TestParseConfigChecks:
     def test_disable_list(self):
@@ -1244,6 +1260,18 @@ class TestMain:
             assert main() == 0
         assert "all checks passed" in capsys.readouterr().out
 
+    def test_from_message_file_utf8_non_ascii(self, tmp_path):
+        f = tmp_path / "msg"
+        f.write_bytes(
+            "fix: handle non-ascii\n\nbody\n\n"
+            "Signed-off-by: Nerijus Bendžiūnas <a@b.com>".encode()
+        )
+        with patch(
+            "sys.argv",
+            ["cg", "--message-file", str(f), "--disable", "signature"],
+        ):
+            assert main() == 0
+
     def test_from_stdin(self):
         stdin = MagicMock()
         stdin.isatty.return_value = False