git-commit-guard 0.22.3__tar.gz → 0.23.1__tar.gz

{git_commit_guard-0.22.3 → git_commit_guard-0.23.1}/.github/workflows/lint-commits.yml

@@ -22,6 +22,6 @@ jobs:
           key: nltk-averaged-perceptron-tagger-punkt
       - name: Lint commits
         # yamllint disable-line rule:line-length
-        uses: benner/commit-guard@e156ca25789cc1824f745d74209f9c2654135dca  # v0.22.2
+        uses: benner/commit-guard@4fb9b57f3883d78854ffe4bbe68ddafac569f269  # v0.23.0
         with:
           range: origin/${{ github.base_ref }}..HEAD

git_commit_guard-0.23.1/.github/workflows/security-audit.yml

@@ -0,0 +1,69 @@
+---
+name: Security Audit
+on:  # yamllint disable-line rule:truthy
+  pull_request:
+  schedule:
+    - cron: 13 3 * * *
+permissions:
+  contents: read
+jobs:
+  audit:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+    steps:
+      - name: Checkout code
+        # yamllint disable-line rule:line-length
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd  # v6.0.2
+        with:
+          persist-credentials: false
+      - name: Install uv
+        # yamllint disable-line rule:line-length
+        uses: astral-sh/setup-uv@fac544c07dec837d0ccb6301d7b5580bf5edae39  # v8.2.0
+      - name: Audit dependencies
+        run: |
+          set -o pipefail
+          uv audit --frozen --preview-features audit-command 2>&1 |
+            tee audit.log
+      - name: Report failure in a tracking issue
+        if: failure() && github.event_name == 'schedule'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          run_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"
+          run_url="$run_url/actions/runs/$GITHUB_RUN_ID"
+          {
+            echo "Scheduled security audit failed: $run_url"
+            echo
+            echo '```'
+            cat audit.log
+            echo '```'
+            echo
+            echo '<!-- security-audit -->'
+          } > issue-body.md
+          issue=$(gh issue list --state open \
+            --search 'Security audit failing in:title' \
+            --json number --jq '.[0].number')
+          if [ -n "$issue" ]; then
+            gh issue comment "$issue" --body-file issue-body.md
+          else
+            gh issue create --title "Security audit failing" \
+              --body-file issue-body.md
+          fi
+      - name: Close the tracking issue
+        if: success() && github.event_name == 'schedule'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |-
+          run_url="$GITHUB_SERVER_URL/$GITHUB_REPOSITORY"
+          run_url="$run_url/actions/runs/$GITHUB_RUN_ID"
+          issue=$(gh issue list --state open \
+            --search 'Security audit failing in:title' \
+            --json number --jq '.[0].number')
+          if [ -n "$issue" ]; then
+            gh issue close "$issue" \
+              --comment "Scheduled security audit is green again: $run_url"
+          fi

{git_commit_guard-0.22.3 → git_commit_guard-0.23.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: git-commit-guard
-Version: 0.22.3
+Version: 0.23.1
 Summary: Opinionated conventional commit message linter with imperative mood detection
 Project-URL: Homepage, https://github.com/benner/commit-guard
 Project-URL: Repository, https://github.com/benner/commit-guard
@@ -316,7 +316,7 @@ COMMIT_GUARD_GIT_TIMEOUT=30 commit-guard --range origin/main..HEAD
 In GitHub Actions, set it at the step or job level:
 
 ```yaml
-- uses: benner/commit-guard@v0.22.3
+- uses: benner/commit-guard@v0.23.1
   env:
     COMMIT_GUARD_GIT_TIMEOUT: 30
   with:
@@ -352,6 +352,22 @@ misconfigured range specs in CI. Use `--allow-empty` to exit 0 instead:
 commit-guard --range origin/main..HEAD --allow-empty
 ```
 
+### Quiet mode
+
+Use `--quiet` (or `-q`) to suppress output for commits that have nothing to
+report — only commits with errors or warnings are printed. On a long range
+this leaves exactly the offending commits in the output; a fully compliant
+range prints nothing and exits 0:
+
+```bash
+commit-guard --range origin/main..HEAD --quiet
+```
+
+Quiet mode applies to single-commit and range mode, in both text and
+`--output jsonl` formats. Exit codes are unchanged, so it composes with CI
+gating. `--output-file` is not affected — the file always receives the
+complete record stream.
+
 ### Machine-readable output
 
 Use `--output jsonl` to emit one JSON line per commit to stdout instead of the
@@ -400,7 +416,7 @@ steps:
   - uses: actions/checkout@v4
     with:
       fetch-depth: 0
-  - uses: benner/commit-guard@v0.22.3
+  - uses: benner/commit-guard@v0.23.1
 ```
 
 Check all commits in a pull request:
@@ -416,7 +432,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.22.3
+      - uses: benner/commit-guard@v0.23.1
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
 ```
@@ -424,7 +440,7 @@ jobs:
 Check a specific commit SHA (mirrors the positional CLI argument):
 
 ```yaml
-      - uses: benner/commit-guard@v0.22.3
+      - uses: benner/commit-guard@v0.23.1
         with:
           rev: ${{ github.sha }}
 ```
@@ -442,7 +458,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.22.3
+      - uses: benner/commit-guard@v0.23.1
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
           disable: signed-off,signature
@@ -462,7 +478,7 @@ jobs:
 When `output-file` is set the action exposes the path as an output:
 
 ```yaml
-      - uses: benner/commit-guard@v0.22.3
+      - uses: benner/commit-guard@v0.23.1
         id: cg
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
@@ -478,7 +494,7 @@ Add to your `.pre-commit-config.yaml`:
 ---
 repos:
   - repo: https://github.com/benner/commit-guard
-    rev: v0.22.3
+    rev: v0.23.1
     hooks:
       - id: commit-guard
       - id: commit-guard-signature

{git_commit_guard-0.22.3 → git_commit_guard-0.23.1}/README.md

@@ -295,7 +295,7 @@ COMMIT_GUARD_GIT_TIMEOUT=30 commit-guard --range origin/main..HEAD
 In GitHub Actions, set it at the step or job level:
 
 ```yaml
-- uses: benner/commit-guard@v0.22.3
+- uses: benner/commit-guard@v0.23.1
   env:
     COMMIT_GUARD_GIT_TIMEOUT: 30
   with:
@@ -331,6 +331,22 @@ misconfigured range specs in CI. Use `--allow-empty` to exit 0 instead:
 commit-guard --range origin/main..HEAD --allow-empty
 ```
 
+### Quiet mode
+
+Use `--quiet` (or `-q`) to suppress output for commits that have nothing to
+report — only commits with errors or warnings are printed. On a long range
+this leaves exactly the offending commits in the output; a fully compliant
+range prints nothing and exits 0:
+
+```bash
+commit-guard --range origin/main..HEAD --quiet
+```
+
+Quiet mode applies to single-commit and range mode, in both text and
+`--output jsonl` formats. Exit codes are unchanged, so it composes with CI
+gating. `--output-file` is not affected — the file always receives the
+complete record stream.
+
 ### Machine-readable output
 
 Use `--output jsonl` to emit one JSON line per commit to stdout instead of the
@@ -379,7 +395,7 @@ steps:
   - uses: actions/checkout@v4
     with:
       fetch-depth: 0
-  - uses: benner/commit-guard@v0.22.3
+  - uses: benner/commit-guard@v0.23.1
 ```
 
 Check all commits in a pull request:
@@ -395,7 +411,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.22.3
+      - uses: benner/commit-guard@v0.23.1
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
 ```
@@ -403,7 +419,7 @@ jobs:
 Check a specific commit SHA (mirrors the positional CLI argument):
 
 ```yaml
-      - uses: benner/commit-guard@v0.22.3
+      - uses: benner/commit-guard@v0.23.1
         with:
           rev: ${{ github.sha }}
 ```
@@ -421,7 +437,7 @@ jobs:
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.22.3
+      - uses: benner/commit-guard@v0.23.1
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
           disable: signed-off,signature
@@ -441,7 +457,7 @@ jobs:
 When `output-file` is set the action exposes the path as an output:
 
 ```yaml
-      - uses: benner/commit-guard@v0.22.3
+      - uses: benner/commit-guard@v0.23.1
         id: cg
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
@@ -457,7 +473,7 @@ Add to your `.pre-commit-config.yaml`:
 ---
 repos:
   - repo: https://github.com/benner/commit-guard
-    rev: v0.22.3
+    rev: v0.23.1
     hooks:
       - id: commit-guard
       - id: commit-guard-signature

{git_commit_guard-0.22.3 → git_commit_guard-0.23.1}/docs/index.html

@@ -551,6 +551,15 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
           readable logs and structured results for downstream steps:
         </p>
         <pre><code class="language-bash">commit-guard --range origin/main..HEAD --output-file results.jsonl</code></pre>
+        <p>
+          Use <code>--quiet</code> (or <code>-q</code>) to suppress output for
+          commits that have nothing to report — only commits with errors or
+          warnings are printed, in both text and JSONL formats. A fully
+          compliant range prints nothing and exits 0. Exit codes are unchanged,
+          and <code>--output-file</code> always receives the complete record
+          stream:
+        </p>
+        <pre><code class="language-bash">commit-guard --range origin/main..HEAD --quiet</code></pre>
       </section>
 
       <section id="github-actions">
@@ -566,13 +575,13 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
       - uses: actions/checkout@v4
         with:
           fetch-depth: 0
-      - uses: benner/commit-guard@v0.22.3
+      - uses: benner/commit-guard@v0.23.1
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
           disable: signed-off,signature</code></pre>
 
         <p>Check a specific commit SHA:</p>
-        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.22.3
+        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.23.1
         with:
           rev: ${{ github.sha }}</code></pre>
 
@@ -591,7 +600,7 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
           When <code>output-file</code> is set the action exposes the path as
           a step output, making JSONL results available to subsequent steps:
         </p>
-        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.22.3
+        <pre><code class="language-yaml">      - uses: benner/commit-guard@v0.23.1
         id: cg
         with:
           range: ${{ env.PR_BASE }}..${{ env.PR_HEAD }}
@@ -604,7 +613,7 @@ require-subject-pattern = "[A-Z]+-[0-9]+"</code></pre>
         <p>Add to <code>.pre-commit-config.yaml</code>:</p>
         <pre><code class="language-yaml">repos:
   - repo: https://github.com/benner/commit-guard
-    rev: v0.22.3
+    rev: v0.23.1
     hooks:
       - id: commit-guard
       - id: commit-guard-signature</code></pre>

{git_commit_guard-0.22.3 → git_commit_guard-0.23.1}/src/git_commit_guard/__init__.py

@@ -146,6 +146,10 @@ class Result:
     def ok(self):
         return not any(lvl == Level.ERROR for _, lvl, _ in self.errors)
 
+    @property
+    def noteworthy(self):
+        return any(lvl in (Level.ERROR, Level.WARN) for _, lvl, _ in self.errors)
+
 
 def _ensure_nltk_data():
     _download_if_missing("taggers/averaged_perceptron_tagger_eng")
@@ -227,22 +231,22 @@ def check_imperative(desc, result):
     if not tokens:
         return
     first = tokens[0]
-    if _NON_IMPERATIVE_SUFFIX_RE.search(first):
+    base = wordnet.morphy(first, wordnet.VERB)
+    if base is not None and base != first:
         result.error(
-            f"expected imperative verb, got '{first}' (non-imperative suffix)",
+            f"expected imperative verb, got '{first}' (inflected form of '{base}')",
             check=Check.IMPERATIVE,
         )
         return
-    base = wordnet.morphy(first, wordnet.VERB)
-    if base is not None and base != first:
+    if base is None and _NON_IMPERATIVE_SUFFIX_RE.search(first):
         result.error(
-            f"expected imperative verb, got '{first}' (inflected form of '{base}')",
+            f"expected imperative verb, got '{first}' (non-imperative suffix)",
             check=Check.IMPERATIVE,
         )
         return
     tagged = nltk.pos_tag(["to", *tokens])
     if tagged[1][1] != "VB":
-        if wordnet.morphy(first, wordnet.VERB) == first:
+        if base == first:
             return
         if "-" in first:
             hyphen_prefix, hyphen_base = first.split("-", 1)
@@ -565,6 +569,7 @@ class Args:
     subject_pattern: re.Pattern | None
     output: OutputFormat
     output_file: Path | None
+    quiet: bool
 
 
 def _resolve_enabled(args, config, parser):
@@ -662,7 +667,7 @@ def _parse_checks(parser, value):
         parser.error(str(e))
 
 
-def _parse_args():  # noqa: PLR0915 Too many statements (59 > 50)
+def _parse_args():  # noqa: PLR0915 Too many statements (60 > 50)
     checks_list = ",".join(sorted(Check))
     parser = ArgumentParser(description="conventional commit checker")
     parser.add_argument("rev", nargs="?", default=None)
@@ -761,6 +766,13 @@ def _parse_args():  # noqa: PLR0915 Too many statements (59 > 50)
         metavar="FILE",
         help="write JSONL results to FILE (text still goes to stdout)",
     )
+    parser.add_argument(
+        "-q",
+        "--quiet",
+        action="store_true",
+        default=False,
+        help="suppress output for commits without errors or warnings",
+    )
     args = parser.parse_args()
     config = _load_config()
     enabled = _resolve_enabled(args, config, parser)
@@ -823,6 +835,7 @@ def _parse_args():  # noqa: PLR0915 Too many statements (59 > 50)
         subject_pattern=subject_pattern,
         output=OutputFormat(args.output),
         output_file=args.output_file,
+        quiet=args.quiet,
     )
 
 
@@ -838,7 +851,9 @@ def _jsonl_record(result, sha, subject):
     }
 
 
-def _report_jsonl(result, sha, subject):
+def _report_jsonl(result, sha, subject, *, quiet=False):
+    if quiet and not result.noteworthy:
+        return 0
     print(json.dumps(_jsonl_record(result, sha, subject)))
     return 0 if result.ok else 1
 
@@ -847,7 +862,9 @@ def _write_jsonl_record(result, sha, subject, file):
     file.write(json.dumps(_jsonl_record(result, sha, subject)) + "\n")
 
 
-def _report_text(result):
+def _report_text(result, *, quiet=False):
+    if quiet and not result.noteworthy:
+        return 0
     color = sys.stdout.isatty()
     for check, level, msg in result.errors:
         prefix = f"[{check}] " if check else ""
@@ -892,6 +909,14 @@ def _run_checks(args, rev, message, result):
         check_signature(rev, result)
 
 
+def _report_commit(args, result, sha, subject):
+    if args.output == OutputFormat.JSONL:
+        return _report_jsonl(result, sha, subject, quiet=args.quiet)
+    if args.rev_range and (not args.quiet or result.noteworthy):
+        print(f"{sha[:7]} {subject}")
+    return _report_text(result, quiet=args.quiet)
+
+
 def main():
     args = _parse_args()
 
@@ -911,13 +936,8 @@ def main():
                 subject = message.split("\n")[0]
                 result = Result()
                 _run_checks(args, rev, message, result)
-                if args.output == OutputFormat.JSONL:
-                    if _report_jsonl(result, rev, subject) != 0:
-                        failed = True
-                else:
-                    print(f"{rev[:7]} {subject}")
-                    if _report_text(result) != 0:
-                        failed = True
+                if _report_commit(args, result, rev, subject) != 0:
+                    failed = True
                 if out_file:
                     _write_jsonl_record(result, rev, subject, out_file)
             return 1 if failed else 0
@@ -927,6 +947,4 @@ def main():
         _run_checks(args, args.rev, args.message, result)
         if out_file:
             _write_jsonl_record(result, args.rev, subject, out_file)
-        if args.output == OutputFormat.JSONL:
-            return _report_jsonl(result, args.rev, subject)
-        return _report_text(result)
+        return _report_commit(args, result, args.rev, subject)