Merge pull request '[bug-yhg8dqypwmar] fix(check-naming): require scoped titles' (#10) from architect/bug-yhg8dqypwmar/require-conventional-titles into main

Authored-By: Codex (GPT-5) <noreply@openai.com>

README.md

@@ -11,7 +11,7 @@ action fails (exits 1) on any violation; `@v1` is the legacy warn-only release
 ```
 Branch:   <role>/bug-<id>/<kebab-description>     e.g. dev/bug-x7k2m9/fix-terminal-resize
 Chore:    chore/<kebab-description>               bug-less trivia only (dep bumps, typos, CI tweaks)
-Title:    [bug-x7k2m9] Fix terminal resize loss   (chore PRs: no [bug-id] prefix)
+Title:    [bug-x7k2m9] fix(terminal): preserve resize state
 ```
 
 - `<role>` must be a roster handle: `dev` | `ux` | `ops` | `security` | `perf` | `architect` | `support`
@@ -23,6 +23,10 @@ Title:    [bug-x7k2m9] Fix terminal resize loss   (chore PRs: no [bug-id] prefix
 ## Usage
 
 ```yaml
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
 jobs:
   naming:
     runs-on: fritzlab
@@ -36,13 +40,17 @@ jobs:
           head-branch: ${{ github.head_ref }}
           pr-title: ${{ github.event.pull_request.title }}
           pr-author: ${{ github.event.pull_request.user.login }}
-          pr-body: ${{ github.event.pull_request.body }}
           server-url: ${{ github.server_url }}
           token: ${{ github.token }}
           base-sha: ${{ github.event.pull_request.base.sha }}
           head-sha: ${{ github.event.pull_request.head.sha }}
 ```
 
+The explicit `edited` activity is part of the enforcement contract: changing
+the PR description must issue a new naming status for the same commit.
+Keep required code-validation jobs in a separate workflow that does not run on
+`edited`; Gitea treats a skipped required context as passing.
+
 To wire a new repo warn-only first, add `continue-on-error: true` to the
 job — the step still fails, but the job cannot block the PR.
 
@@ -53,7 +61,6 @@ job — the step still fails, but the job cannot block the PR.
 | `head-branch` | yes | Head branch name — `github.head_ref` |
 | `pr-title` | yes | PR title — `github.event.pull_request.title` |
 | `pr-author` | no | PR author login — `github.event.pull_request.user.login`; `dfritz` is exempt |
-| `pr-body` | yes | PR description — `github.event.pull_request.body` |
 | `server-url` | yes | Gitea server URL — `github.server_url` |
 | `token` | yes | Gitea Actions token — `github.token` |
 | `base-sha` | yes | Base commit — `github.event.pull_request.base.sha` |
@@ -67,18 +74,20 @@ The check validates four things for every non-break-glass Agent PR:
    Unknown roles, missing `bug-` segment, uppercase bug-ids, and empty
    kebab descriptions all produce a `FAIL[check-naming]` log line.
 
-2. **Title form** — for a `role/bug` branch the title must start with
-   `[bug-<id>] `. For a `chore` branch the title must have no `[bug-id]`
-   prefix. If both carry a bug-id they must match. The description is a
-   plain-language imperative; Conventional Commit forms such as `fix(scope):`
-   are rejected.
+2. **Title form** — for a `role/bug` branch the title must be
+   `[bug-<id>] type(scope): description`. The type starts with a lowercase
+   letter and the type and one-component scope contain only lowercase letters,
+   digits, and hyphens. An optional `!` may follow the scope, and the description
+   must contain a non-whitespace character. For a `chore` branch the title must
+   have no `[bug-id]` prefix. If both carry a bug-id they must match.
 
 3. **Tracking and attribution** — on Bug-backed work, `## Tracking` contains both the literal
    `Fixes bug-<id>` automation token and the matching navigable
    `https://agenthub.fritzlab.net/bug-<id>` URL. Every PR has a separate
    `## Attribution` section containing the canonical `Authored-By`
-   product/model watermark. The action asks Gitea to render the body with a
-   bounded 5-second connection and 15-second total wait, then checks visible
+   product/model watermark. The action loads the body from Gitea by repository
+   and PR number, then asks Gitea to render it; both calls have a bounded
+   5-second connection and 15-second total wait. It then checks visible
    `<h2>` sections outside collapsed `<details>` content. Fenced, commented,
    scripted, or collapsed copies do not satisfy the visible provenance contract.
 

action.yaml

@@ -8,7 +8,7 @@ description: |
   Standard:
     branch:   <role>/bug-<id>/<kebab>   e.g. dev/bug-x7k2m9/fix-terminal-resize
     chore:    chore/<kebab>              bug-less trivia only
-    title:    [bug-<id>] Description    (chore PRs: no [bug-id] prefix)
+    title:    [bug-<id>] type(scope): description
 
   Role must be a roster handle: dev | ux | ops | security | perf | architect | support
   Break-glass: PRs authored by dfritz are exempt.
@@ -26,9 +26,6 @@ inputs:
       dfritz is exempt from all checks.
     required: false
     default: ''
-  pr-body:
-    description: PR description — github.event.pull_request.body.
-    required: true
   server-url:
     description: Gitea server URL — github.server_url.
     required: true
@@ -51,9 +48,10 @@ runs:
         HEAD_BRANCH: ${{ inputs.head-branch }}
         PR_TITLE: ${{ inputs.pr-title }}
         PR_AUTHOR: ${{ inputs.pr-author }}
-        PR_BODY: ${{ inputs.pr-body }}
         GITEA_SERVER_URL: ${{ inputs.server-url }}
         GITEA_TOKEN: ${{ inputs.token }}
+        GITEA_REPOSITORY: ${{ github.repository }}
+        GITEA_PR_NUMBER: ${{ github.event.pull_request.number }}
         BASE_SHA: ${{ inputs.base-sha }}
         HEAD_SHA: ${{ inputs.head-sha }}
       run: bash "${{ github.action_path }}/check.sh"

check.sh

@@ -7,11 +7,12 @@ set -euo pipefail
 BRANCH="${HEAD_BRANCH:-}"
 TITLE="${PR_TITLE:-}"
 AUTHOR="${PR_AUTHOR:-}"
-BODY="${PR_BODY:-}"
 BASE="${BASE_SHA:-}"
 HEAD="${HEAD_SHA:-}"
 SERVER_URL="${GITEA_SERVER_URL:-}"
 TOKEN="${GITEA_TOKEN:-}"
+REPOSITORY="${GITEA_REPOSITORY:-}"
+PR_NUMBER="${GITEA_PR_NUMBER:-}"
 
 # Break-glass: dfritz is exempt from all naming checks.
 if [ "${AUTHOR}" = "dfritz" ]; then
@@ -26,8 +27,19 @@ BRANCH_BUG=""
 # Gitea's renderer is the visibility contract. Validate its output instead of
 # maintaining a second Markdown parser in this action.
 RENDERED_BODY=""
-if [ -z "${SERVER_URL}" ] || [ -z "${TOKEN}" ]; then
-  echo "FAIL[check-naming]: server-url and token are required to render the PR body"
+BODY=""
+if [ -z "${SERVER_URL}" ] || [ -z "${TOKEN}" ] ||
+  ! printf '%s' "${REPOSITORY}" | grep -qE '^[[:alnum:]_.-]+/[[:alnum:]_.-]+$' ||
+  ! printf '%s' "${PR_NUMBER}" | grep -qE '^[1-9][0-9]*$'; then
+  echo "FAIL[check-naming]: server-url, token, repository, and PR number are required to load the PR body"
+  FAILED=1
+elif ! BODY=$(curl --fail --silent --show-error \
+  --connect-timeout 5 \
+  --max-time 15 \
+  --header "Authorization: token ${TOKEN}" \
+  "${SERVER_URL%/}/api/v1/repos/${REPOSITORY}/pulls/${PR_NUMBER}" |
+  jq -er '.body | if type == "string" then . else error("body is not a string") end'); then
+  echo "FAIL[check-naming]: Gitea could not load the PR body"
   FAILED=1
 elif ! RENDERED_BODY=$(printf '%s' "${BODY}" |
   jq -Rs '{Text: ., Mode: "gfm"}' |
@@ -109,21 +121,18 @@ if echo "${TITLE}" | grep -qE "^\[bug-[a-z0-9]+\] ."; then
   TITLE_BUG=$(echo "${TITLE}" | sed -E 's|^\[(bug-[a-z0-9]+)\].*|\1|')
 fi
 
-TITLE_DESCRIPTION=$(printf '%s\n' "${TITLE}" | sed -E 's/^\[bug-[a-z0-9]+\] //')
-if printf '%s\n' "${TITLE_DESCRIPTION}" | grep -qE '^[[:alnum:]-]+(\([^)]*\))?!?:[[:space:]]'; then
-  echo "FAIL[check-naming]: title must use a plain-language imperative without Conventional Commit syntax"
-  FAILED=1
-fi
-
 if [ "${BRANCH_KIND}" = "role-bug" ]; then
   if [ -z "${TITLE_BUG}" ]; then
     echo "FAIL[check-naming]: title must lead with [${BRANCH_BUG}]"
     echo "  have: ${TITLE}"
-    echo "  want: [${BRANCH_BUG}] ${TITLE}"
+    echo "  want: [${BRANCH_BUG}] fix(scope): description"
     FAILED=1
   elif [ "${TITLE_BUG}" != "${BRANCH_BUG}" ]; then
     echo "FAIL[check-naming]: bug-id mismatch — branch carries '${BRANCH_BUG}' but title carries '${TITLE_BUG}'"
     FAILED=1
+  elif ! printf '%s\n' "${TITLE}" | grep -qE "^\\[${BRANCH_BUG}\\] [a-z][a-z0-9-]*\\([a-z0-9][a-z0-9-]*\\)!?: .*[^[:space:]]$"; then
+    echo "FAIL[check-naming]: Bug-backed title must use '[${BRANCH_BUG}] type(scope): description'"
+    FAILED=1
   fi
 
   tracking=$(printf '%s\n' "${VISIBLE_BODY}" | awk '

tests/bin/curl

@@ -4,6 +4,7 @@ set -euo pipefail
 
 connect_timeout=0
 total_timeout=0
+url=""
 while [ "$#" -gt 0 ]; do
   case "$1" in
     --connect-timeout)
@@ -16,20 +17,38 @@ while [ "$#" -gt 0 ]; do
       total_timeout=1
       shift 2
       ;;
+    --header|--data-binary)
+      shift 2
+      ;;
+    http*)
+      url="$1"
+      shift
+      ;;
     *) shift ;;
   esac
 done
 [ "${connect_timeout}" -eq 1 ] && [ "${total_timeout}" -eq 1 ] || exit 2
 
-if printf '%s\n' "${PR_BODY}" | grep -Fq '[[stall-renderer]]'; then
-  exit 28
-fi
-
-if printf '%s\n' "${PR_BODY}" | grep -Fq '<!--'; then
+if [[ "${url}" == */api/v1/repos/action/check-naming/pulls/1 ]]; then
+  if [ -n "${TEST_PR_BODY_FILE:-}" ]; then
+    jq -Rs '{body: .}' < "${TEST_PR_BODY_FILE}"
+  else
+    printf '%s' "${PR_BODY:-}" | jq -Rs '{body: .}'
+  fi
   exit 0
 fi
 
-printf '%s\n' "${PR_BODY}" | awk '
+BODY=$(jq -r '.Text')
+
+if printf '%s\n' "${BODY}" | grep -Fq '[[stall-renderer]]'; then
+  exit 28
+fi
+
+if printf '%s\n' "${BODY}" | grep -Fq '<!--'; then
+  exit 0
+fi
+
+printf '%s\n' "${BODY}" | awk '
   {
     line=$0
     lower=tolower(line)

tests/run

@@ -29,7 +29,8 @@ check() {
   body=$(canonical_body "${bug:-bug-test}")
   local out rc=0
   out=$(cd "${FIXTURES}" && HEAD_BRANCH="$branch" PR_TITLE="$title" PR_AUTHOR="$author" \
-    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" PATH="${TEST_BIN}:$PATH" \
+    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" \
+    GITEA_REPOSITORY="action/check-naming" GITEA_PR_NUMBER=1 PATH="${TEST_BIN}:$PATH" \
     BASE_SHA="$BASE" HEAD_SHA="$GOOD_HEAD" bash "$SCRIPT" 2>&1) || rc=$?
   local got_lines=0
   echo "$out" | grep -qE "^FAIL" && got_lines=1 || true
@@ -47,8 +48,9 @@ check_contract() {
   local desc="$1" body="$2" base="$3" head="$4" diagnostic="$5"
   local out rc=0
   out=$(cd "${FIXTURES}" && HEAD_BRANCH="architect/bug-x7k2m9/contract" \
-    PR_TITLE="[bug-x7k2m9] Enforce contract" PR_AUTHOR="architect" \
-    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" PATH="${TEST_BIN}:$PATH" \
+    PR_TITLE="[bug-x7k2m9] fix(check): enforce contract" PR_AUTHOR="architect" \
+    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" \
+    GITEA_REPOSITORY="action/check-naming" GITEA_PR_NUMBER=1 PATH="${TEST_BIN}:$PATH" \
     BASE_SHA="$base" HEAD_SHA="$head" bash "$SCRIPT" 2>&1) || rc=$?
   if [ "$rc" -eq 1 ] && printf '%s\n' "$out" | grep -Fq "$diagnostic"; then
     echo "PASS [$desc]"
@@ -64,8 +66,9 @@ check_contract_pass() {
   local desc="$1" body="$2" base="$3" head="$4"
   local out rc=0
   out=$(cd "${FIXTURES}" && HEAD_BRANCH="architect/bug-x7k2m9/contract" \
-    PR_TITLE="[bug-x7k2m9] Enforce contract" PR_AUTHOR="architect" \
-    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" PATH="${TEST_BIN}:$PATH" \
+    PR_TITLE="[bug-x7k2m9] fix(check): enforce contract" PR_AUTHOR="architect" \
+    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" \
+    GITEA_REPOSITORY="action/check-naming" GITEA_PR_NUMBER=1 PATH="${TEST_BIN}:$PATH" \
     BASE_SHA="$base" HEAD_SHA="$head" bash "$SCRIPT" 2>&1) || rc=$?
   if [ "$rc" -eq 0 ] && printf '%s\n' "$out" | grep -Fq "check-naming: ok"; then
     echo "PASS [$desc]"
@@ -82,7 +85,8 @@ check_chore_contract() {
   local out rc=0
   out=$(cd "${FIXTURES}" && HEAD_BRANCH="chore/contract" \
     PR_TITLE="Improve delivery contract" PR_AUTHOR="dev" \
-    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" PATH="${TEST_BIN}:$PATH" \
+    PR_BODY="$body" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" \
+    GITEA_REPOSITORY="action/check-naming" GITEA_PR_NUMBER=1 PATH="${TEST_BIN}:$PATH" \
     BASE_SHA="$base" HEAD_SHA="$head" bash "$SCRIPT" 2>&1) || rc=$?
   if [ "$rc" -eq 1 ] && printf '%s\n' "$out" | grep -Fq "$diagnostic"; then
     echo "PASS [$desc]"
@@ -99,13 +103,13 @@ check "dfritz exempt — invalid branch"  0 "totally/wrong-branch" "no prefix"
 check "dfritz exempt — mismatch"        0 "dev/bug-abc/thing"    "[bug-xyz] Thing"          "dfritz"
 
 # valid role/bug — all roster handles
-check "dev/bug matching title"          0 "dev/bug-x7k2m9/fix-terminal-resize" "[bug-x7k2m9] Fix terminal resize"  "dev"
-check "architect/bug matching title"    0 "architect/bug-abc123/refactor-auth"  "[bug-abc123] Refactor auth"        "architect"
-check "ops/bug matching title"          0 "ops/bug-zz9/deploy-tweak"            "[bug-zz9] Deploy tweak"            "ops"
-check "security/bug matching title"     0 "security/bug-s1a2/patch-cve"         "[bug-s1a2] Patch CVE"              "security"
-check "perf/bug matching title"         0 "perf/bug-p0p0/reduce-latency"        "[bug-p0p0] Reduce latency"         "perf"
-check "ux/bug matching title"           0 "ux/bug-u1u1/polish-modal"            "[bug-u1u1] Polish modal"           "ux"
-check "support/bug matching title"      0 "support/bug-sup9/clarify-error"      "[bug-sup9] Clarify error"          "support"
+check "dev/bug matching title"          0 "dev/bug-x7k2m9/fix-terminal-resize" "[bug-x7k2m9] fix(terminal): preserve resize" "dev"
+check "architect/bug matching title"    0 "architect/bug-abc123/refactor-auth"  "[bug-abc123] refactor(auth): simplify boundary" "architect"
+check "ops/bug matching title"          0 "ops/bug-zz9/deploy-tweak"            "[bug-zz9] fix(delivery): preserve rollout" "ops"
+check "security/bug matching title"     0 "security/bug-s1a2/patch-cve"         "[bug-s1a2] fix(auth): close bypass" "security"
+check "perf/bug matching title"         0 "perf/bug-p0p0/reduce-latency"        "[bug-p0p0] perf(checker): reduce latency" "perf"
+check "ux/bug matching title"           0 "ux/bug-u1u1/polish-modal"            "[bug-u1u1] fix(modal): preserve focus" "ux"
+check "support/bug matching title"      0 "support/bug-sup9/clarify-error"      "[bug-sup9] docs(error): clarify recovery" "support"
 
 # valid chore form
 check "chore — no title prefix"         0 "chore/bump-deps"   "Bump dependency versions"  "dev"
@@ -119,9 +123,13 @@ check "bug-id mismatch"                 1 "dev/bug-x7k2m9/fix-resize"     "[bug-
 
 # fail: chore branch with [bug-id] title prefix
 check "chore with bug-id title"         1 "chore/bump-deps"                "[bug-abc123] Bump deps"      "dev"
-check "role/bug Conventional title"     1 "dev/bug-x7k2m9/fix-resize"     "[bug-x7k2m9] fix(hub): fix resize" "dev"
-check "chore Conventional title"        1 "chore/bump-deps"                "chore(deps): bump deps"      "dev"
-check "role/bug breaking title"         1 "dev/bug-x7k2m9/fix-resize"     "[bug-x7k2m9] fix!: break resize" "dev"
+check "role/bug Conventional title"     0 "dev/bug-x7k2m9/fix-resize"     "[bug-x7k2m9] fix(hub): fix resize" "dev"
+check "role/bug plain title"            1 "dev/bug-x7k2m9/fix-resize"     "[bug-x7k2m9] Fix resize"           "dev"
+check "role/bug missing scope"          1 "dev/bug-x7k2m9/fix-resize"     "[bug-x7k2m9] fix: fix resize"      "dev"
+check "role/bug path scope"             1 "dev/bug-x7k2m9/fix-resize"     "[bug-x7k2m9] fix(hub/bugs): fix resize" "dev"
+check "role/bug empty description"      1 "dev/bug-x7k2m9/fix-resize"     "[bug-x7k2m9] fix(hub): "            "dev"
+check "role/bug whitespace description" 1 "dev/bug-x7k2m9/fix-resize"    "[bug-x7k2m9] fix(hub):   "           "dev"
+check "chore Conventional title"        0 "chore/bump-deps"                "chore(deps): bump deps"      "dev"
 
 # fail: invalid branch forms
 check "invalid — no role prefix"        1 "feature/foo-bar"                "Add feature"                 "dev"
@@ -205,6 +213,25 @@ check_contract "stalled renderer fails closed at the curl timeout" \
   "$(canonical_body bug-x7k2m9)"$'\n[[stall-renderer]]' \
   "$BASE" "$GOOD_HEAD" "Gitea could not render the PR body"
 
+LARGE_BODY="${FIXTURES}/large-pr-body"
+awk 'BEGIN { for (i=0; i<150000; i++) printf "x"; print "" }' > "${LARGE_BODY}"
+canonical_body bug-x7k2m9 >> "${LARGE_BODY}"
+large_out=""
+large_rc=0
+large_out=$(cd "${FIXTURES}" && HEAD_BRANCH="architect/bug-x7k2m9/contract" \
+  PR_TITLE="[bug-x7k2m9] fix(check): enforce contract" PR_AUTHOR="architect" \
+  TEST_PR_BODY_FILE="${LARGE_BODY}" GITEA_SERVER_URL="https://code.test" GITEA_TOKEN="test-token" \
+  GITEA_REPOSITORY="action/check-naming" GITEA_PR_NUMBER=1 PATH="${TEST_BIN}:$PATH" \
+  BASE_SHA="$BASE" HEAD_SHA="$GOOD_HEAD" bash "$SCRIPT" 2>&1) || large_rc=$?
+if [ "${large_rc}" -eq 0 ] && printf '%s\n' "${large_out}" | grep -Fq "check-naming: ok"; then
+  echo "PASS [large PR body loads without environment transport]"
+  PASS=$((PASS + 1))
+else
+  echo "FAIL [large PR body loads without environment transport]: expected exit=0 and check-naming: ok, got exit=${large_rc}"
+  echo "  output: ${large_out}"
+  FAIL=$((FAIL + 1))
+fi
+
 git -C "${FIXTURES}" commit --allow-empty -q -m "unwatermarked change"
 BAD_HEAD=$(git -C "${FIXTURES}" rev-parse HEAD)
 check_contract "agenthub 779 commits reject missing watermark" "$BODY" "$GOOD_HEAD" "$BAD_HEAD" "must end with an Authored-By"