Skip to content

fix(commit-validate): guard extractMessage against non-commit commands#83

Open
slava07437352641-ops wants to merge 1 commit into
rohitg00:mainfrom
slava07437352641-ops:fix/commit-validate-false-positive
Open

fix(commit-validate): guard extractMessage against non-commit commands#83
slava07437352641-ops wants to merge 1 commit into
rohitg00:mainfrom
slava07437352641-ops:fix/commit-validate-false-positive

Conversation

@slava07437352641-ops

@slava07437352641-ops slava07437352641-ops commented Jul 20, 2026

Copy link
Copy Markdown

Fixes #82.

Bug

extractMessage() in scripts/commit-validate.js runs its -m/--message/heredoc/-F/--file sub-patterns unconditionally, with no check that the command is actually a git commit. Any Bash command containing a heredoc, or an unrelated -m flag, gets misread as a commit message and validated against the conventional-commit pattern — blocking work that has nothing to do with committing.

Concretely, this blocks something as simple as:

cat > file.py << 'EOF'
import json
EOF

Fix

Add an early guard so none of the sub-patterns run unless the command actually contains a real git commit invocation.

Verification

Tested directly against the patched script:

  • Heredoc / non-commit commands → pass through silently (exit 0)
  • Valid conventional commit (git commit -m "feat: add thing") → passes (exit 0)
  • Invalid commit message (git commit -m "not conventional") → still blocks correctly (exit 2), same error as before

No existing tests reference this script, so no test suite changes.

Summary by CodeRabbit

  • Bug Fixes
    • Improved command validation so non-commit Git commands are identified early and excluded from commit-message processing.
    • Prevented unrelated commands from being incorrectly interpreted as commit operations.

@coderabbitai

coderabbitai Bot commented Jul 20, 2026

Copy link
Copy Markdown
Contributor

Review Change Stack

📝 Walkthrough

Walkthrough

extractMessage now checks for a Git commit command before evaluating message, heredoc, or file flags, returning not-a-commit for unrelated commands.

Changes

Commit validation

Layer / File(s) Summary
Early commit command guard
scripts/commit-validate.js
extractMessage now returns { msg: null, form: 'not-a-commit' } when the command does not match a Git commit pattern before parsing message options.

Estimated code review effort: 2 (Simple) | ~5 minutes

🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title is concise and accurately describes the main change: guarding commit validation against non-commit commands.
Linked Issues check ✅ Passed The change matches issue #82 by returning early for non-commit commands before heredoc or -m/-F parsing runs.
Out of Scope Changes check ✅ Passed The PR is narrowly scoped to the requested extractMessage guard and introduces no unrelated changes.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands.

@coderabbitai coderabbitai Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🧹 Nitpick comments (1)
scripts/commit-validate.js (1)

18-26: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Remove redundant git commit check.

The addition of this early guard guarantees that the command contains a git commit invocation. Consequently, the identical regex check at line 46 is now always true, making it redundant, and the fallback return at line 53 is unreachable dead code.

Consider replacing lines 46-53 with the simplified logic:

  const afterCommit = command.split(/\bcommit\b/)[1] || '';
  const hasExplicitFlag = /(?:-m|--message|-F|--file|--amend)\b/.test(afterCommit);
  if (!hasExplicitFlag) return { msg: null, form: 'editor' };
  return { msg: null, form: 'unknown' };
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@scripts/commit-validate.js` around lines 18 - 26, Simplify the post-guard
command classification by removing the redundant git commit regex check and its
unreachable fallback in the commit-validation flow. After the existing guard,
derive the text after the commit keyword, detect explicit message-related flags
there, and return the editor form when absent or unknown when present.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@scripts/commit-validate.js`:
- Around line 18-26: Simplify the post-guard command classification by removing
the redundant git commit regex check and its unreachable fallback in the
commit-validation flow. After the existing guard, derive the text after the
commit keyword, detect explicit message-related flags there, and return the
editor form when absent or unknown when present.

ℹ️ Review info
⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: b84080a6-2d72-4909-8a4c-5de6e8c53e9d

📥 Commits

Reviewing files that changed from the base of the PR and between 7f7209d and fe37be4.

📒 Files selected for processing (1)
  • scripts/commit-validate.js

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

commit-validate.js false-positives on any heredoc or -m flag, unrelated to git commit

1 participant