action-semantic-pull-request VS commit-analyzer

Here you go: https://github.com/amannn/action-semantic-pull-request

I am not too familiar with GitLab, to be honest, but: - Commit/PR linting (to be in tandem with semantic versioning) is implemented via third-party GitHub Actions (https://github.com/amannn/action-semantic-pull-request and https://github.com/wagoid/commitlint-github-action), these might be hard to transfer - Blocking egress to mitigate supply chain attacks is performed by step security’s Harden Runner (https://github.com/step-security/harden-runner), you may raise a question there about GitLab support - CodeQL support is GitHub only AFAIK (but you would have to verify it)

There are many great tools to help with automation here, some of them are action-semantic-pull-request to enforce conventional commits and standard version to bump the version and create a changelog according to the conventional commits.

+1 on conventional commits (big fan)

also, +1 on fully paved road approach!

You might want to check out this GitHub Action to enforce PR title matches the spec: https://github.com/amannn/action-semantic-pull-request

amannn/[email protected] - ensures pull request title matches conventional commits specification

@semantic-release/commit-analyzer to analyze commit messages with respect to conventional commit conventions

Semantic Release is a tool that automates semantic versioning and release creation based on the content of changes made to the source code. By adopting this approach, the tool analyzes commits since the last version, automatically determines the version type (major, minor, or patch) based on the changes made, and then generates a new tag and release. This not only streamlines the process but also ensures consistency and accuracy in your software versions. See default release rules.

@semantic-release/commit-analyzer - analyzes conventional commits deciding if they are bumping a patch, minor or major release tag

@semantic-release/commit-analyzer