GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Commit Check
  • Browse all rules →
  • Command line
  • pre-commit hook
  • GitHub Action
  • GitHub App
  • MCP server
  • Configuration
  • Troubleshooting
  • Changelog
  • GitHub's built-in rules
  • Other tools
  • Conventional Branch
  • Discussions

This view

  • Original page
  • New address

GeezerVison is showing commit-check.com — Commit Check

Open source · MIT licensed

Catch bad commits before they merge.

Commit policy as code for teams and AI agents. Commit Check validates commit messages, branch names, authors and sign-offs against one cchk.toml — in your commit hook, in CI, on every pull request and inside your AI agent. When the fix is obvious, it hands you the line.

Install the GitHub App
$pip install commit-check
~/app · feature/streaming · commit-msg hook
❯ git commit -m "Fix: add streaming support"
check commit messageFailed
- hook id: check-message
- exit code: 1
✖ Commit rejected by Commit Check · 1 check failed
✖ CC001 message failed: Fix: add streaming support
The commit message should follow Conventional Commits. See https://www.conventionalcommits.org
Suggest: Use "fix: add streaming support"
Docs: https://commit-check.com/rules/#cc001
❯ git commit -m "fix: add streaming support"
check commit messagePassed
[feature/streaming 276fd07] fix: add streaming support
  • MIT licensed, no account needed
  • Python 3.11 – 3.15 on Linux, macOS and Windows
  • Signed build provenance on every release
  • CLI and hook work with any Git host

cchk.toml

[commit] conventional_commits = true subject_max_length = 80 [branch] conventional_branch = true
  • Any forge, any CI Command line The engine itself, with JSON output and a Python API for scripts. pip install commit-check Getting started →
  • Fastest feedback pre-commit hook Rejects a bad message on the laptop, before Git records it. - id: check-message Hook guide →
  • Fastest to set up Zero YAML GitHub App Install once. Every push and pull request gets a check run, no CI minutes. apps/commit-check App guide →
  • Enforced in CI GitHub Action A required check no one can skip, with a PR comment and a job summary. commit-check-action@v2 Action guide →
  • For AI agents MCP server Your coding agent checks its own commit before it writes it. uvx commit-check-mcp MCP guide →

Not sure which? Compare them side by side →

One report on the pull request, edited in place on every push.Turn it on with pr-comments: true

github.com/acme/widgets/pull/128

feat: add login page #128Open

alex wants to merge 3 commits into main from feature/add-login

Conversation 4Commits 3Checks 2Files changed 6

github-actionsbot commentededited

Commit Check failed

Pull request: passedCommits: 2 of 3 failedBranch: passed

@@ 5584f46 @@
- bad msg
# Use <type>(<scope>): <description>
@@ 37d6def @@
- Fix: handle empty password
+ fix: handle empty password

Commits: 5584f46 37d6def  |  Rules: CC001

▸ How to fix

▸ All 5 checks

Commit Check passed

Pull request: passedCommits: 3 passedBranch: passed

▸ All 5 checks

Checked by Commit Check · Rules · Check before you push

alex force-pushed feature/add-login, rewording 2 commits

The same comment was updated. No new comment, no noise in the thread.

The full breakdown lands in the workflow run: each check, the value, the fix.Turn it on with job-summary: true

github.com/acme/widgets/actions/runs/1180
SummaryJobscommit-checkRun detailsUsageWorkflow file

commit-check summary

Commit Check failed

Pull request: passedCommits: 2 of 3 failedBranch: passed

@@ 5584f46 @@
- bad msg
# Use <type>(<scope>): <description>
@@ 37d6def @@
- Fix: handle empty password
+ fix: handle empty password

Commits: 5584f46 37d6def  |  Rules: CC001

▾ How to fix

With an AI coding agent. Paste this prompt:

Fix these Commit Check findings without changing any code:
- Commit 5584f46 "bad msg": Use <type>(<scope>): <description>
- Commit 37d6def: change "Fix: handle empty password" to "fix: handle empty password"

Commit messages. Reword them, then force-push:

git rebase -i 5584f46~1 # change "pick" to "reword" on the commits above
git push --force-with-lease

▸ All 5 checks

Checked by Commit Check · Rules · Check before you push

Squash merges turn the PR title into the commit, so the title is checked too.Turn it on with pr-title: true

github.com/acme/widgets/pull/128

add login page #128Open

feat: add login pageSave

feat: add login page #128Open

alex wants to merge 3 commits into main from feature/add-login

Conversation 4Commits 3Checks 2Files changed 6

Checks

Commit Check / commit-check (pull_request)CC001 message · PR title (add login page)Re-running on the edited title…✔ PR title (feat: add login page)

Squash and merge creates this commit on main:

feat: add login page (#128)

Squash and mergeSquash and mergeA required check has not passedAll checks have passed

Every commit in the pull request, checked against Conventional Commits.On by default: message: true

github.com/acme/widgets/pull/128/checks

feat: add login page #128Open

alex wants to merge 3 commits into main from feature/add-login

Conversation 4Commits 3Checks 2Files changed 6

Commit message

feat: add login paged87faca
bad msg5584f46
Fix: handle empty password37d6def

Annotations 2 errors

CC001 message

Commit 2/3 (5584f46) "bad msg": Use <type>(<scope>): <description>
The commit message should follow Conventional Commits.

CC001 message

Commit 3/3 (37d6def): change "Fix: handle empty password" to "fix: handle empty password"
The commit message should follow Conventional Commits.

Branch names checked against Conventional Branch, with the rename to run.On by default: branch: true

github.com/acme/widgets/pull/131/checks

feat: add login page #131Open

alex wants to merge 1 commit into main from Feature/Add-Login

Conversation 1Commits 1Checks 1Files changed 6

BranchFeature/Add-Login

CC201 The branch should follow Conventional Branch.

value: Feature/Add-Login
Fix: feature/Add-Login

❯ git branch -m feature/Add-Login
❯ commit-check --branch && echo passed
passed

Conventional Branch types

  • feature/
  • bugfix/
  • hotfix/
  • release/
  • chore/

main and master always pass. Add your own types in cchk.toml.

.github/workflows/commit-check.yml

on: pull_request: types: [opened, synchronize, reopened, edited] permissions: contents: read pull-requests: write jobs: commit-check: runs-on: ubuntu-latest steps: - uses: actions/checkout@v7 with: fetch-depth: 0 - uses: commit-check/commit-check-action@v2 with: pr-title: true pr-comments: true

Make it a required check

Branch protection does the rest: a violating commit cannot merge, however it was made.

Verified before it installs

The Action checks the wheel's signed build provenance and fails the step if it does not match.

Try it without blocking anyone

dry-run: true reports every finding as a warning and always exits 0.

Read the Action guide →View on Marketplace →

  • Commit messagesCC001–CC012

    Conventional Commits, subject length, imperative mood, sign-off, and merge, revert, fixup or WIP commits.

    ✖Rejected: Fix: add streaming support

    ✔Accepted: fix: add streaming support

  • Branch namesCC201–CC202

    Conventional Branch naming, and whether the branch is rebased onto its target.

    ✖Rejected: my-new-thing

    ✔Accepted: feature/streaming-support

  • AI attributionCC013–CC016

    Spots the trailers Claude Code, Cursor and others add. Forbid them, or require a disclosure instead.

    ✖Rejected: Co-authored-by: Claude

    ✔Accepted: Assisted-by: Claude

  • Author identityCC101–CC102

    Names and emails that match the patterns you set — here author_email_pattern = "@acme\.dev$" — so a build box cannot write itself into the history.

    ✖Rejected: ec2-user <root@ip-10-0-0-12>

    ✔Accepted: Jane Doe <[email protected]>

  • Pushes and filesCC301–CC304

    No force-pushes, no oversized files, no forbidden paths — caught at pre-push, before they leave the laptop.

    ✖Rejected: git push --force origin main

    ✖Rejected: assets/model.bin, 240 MB

  • Across an organization

    One shared policy for every repository. Each repo inherits it and overrides only what differs.

    inherit_from = "github:acme/.github:cchk.toml"

    Organization guide →

Every finding

Not just “failed”. What failed, and the fix.

  1. A stable rule ID that links to its documentation.
  2. The exact value that was checked.
  3. Why it failed, in one sentence.
  4. A fix you can paste, whenever the correction is unambiguous.

$ echo "Fix: add streaming support" | commit-check -m

1✖ CC001 message failed:

2Fix: add streaming support

3The commit message should follow Conventional Commits. See https://www.conventionalcommits.org

4Suggest: Use "fix: add streaming support"

Docs: https://commit-check.com/rules/#cc001

  • 1.6M+downloads on PyPI
  • 160+repositories run the Action
  • Apacheallowlists the Action for its projects' CI

In the CI ofApacheFreeBSDJUnitTexas InstrumentsMilaIstio EcosystemOpenDriveLaband more →

  • Open Source

    Free

    Public repositories, on any account.

    Install the App →
  • Personal

    Free

    Private repositories on a personal account.

    Install the App →
  • Team

    Coming soon

    Private repositories in an organization. Until it launches, the App checks them at no charge.

    How the plan will work →

Nothing is blocked while you try it: without a config file the App reports its findings but leaves the check run neutral. GitHub's own commit-metadata rules sit behind its Enterprise plan — the arithmetic, and the caveats →

Questions¶

Does it read my source code?

No. The CLI validates commit metadata and never opens your files. The hosted App uses a blob-filtered fetch and a sparse checkout that materializes only the config files, so no other repository content is ever downloaded. Content scanning is deliberately out of scope.

Can a developer bypass it?

The pre-commit hook, yes: git commit --no-verify is one flag, and a local hook is there for fast feedback. The enforcement boundary is CI. Make the Action or the App a required status check and a violating change cannot merge, however it was committed.

Will turning it on block everyone tomorrow?

No. Without a config file the App reports in full but leaves the check neutral, and it never rejects a push. Most rules are off until you turn them on — the rules reference marks which start on.

What about the history I already have?

Only new commits are checked. Nothing asks you to rewrite what is already merged.

Does it only work on GitHub?

The CLI and the pre-commit hook run anywhere Git does — GitLab, Gitea, Bitbucket, a local machine. The Action and the App are GitHub-specific because they integrate with GitHub's check runs.

Do I need Node.js?

No. On a modern Python there are no runtime dependencies at all.

Which Python versions are supported?

3.11 through 3.15. On every change, CI builds the wheel and installs it on all five, across Linux, macOS and Windows — fifteen combinations.

How do I know the package I installed is the one you built?

Every release carries a signed build provenance attestation naming the workflow in this repository that built it. Check a wheel yourself with gh attestation verify <file> --repo commit-check/commit-check; the GitHub Action runs the same check before it installs anything, and fails the step if verification does not pass.

Who is behind this?

Commit Check is written and maintained by Xianpeng Shen, who also runs the hosted App. The engine, the Action, the App and the MCP server are open source under the commit-check organization — if the hosted App ever stops, the GitHub Action reads the same config and reports the same rule IDs.

Start with two commands.

No config file needed. The defaults check Conventional Commits, Conventional Branch and subject length; tighten them when you are ready.

Read the quickstart Star on GitHub

$ pip install commit-check

$ commit-check --message --branch

You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.