Skip to main content

Validate Commits

Validate commit messages and metadata.

Usage

$ validate-commits --help
usage: validate-commits [-h] [--since SINCE]

options:
  -h, --help     show this help message and exit
  --since SINCE  check commits since this reference

The tool will check all commits between main and the current HEAD.

Checks

Built-in rules

There are several built-in rules, which are checked automatically:

  • "Commit author has no email" -- all commits must have an author email and all co-authors (in Co-authored-by trailers) must have an email.
  • "Commit is empty" -- empty commits are not allowed.
  • "Fixup commit" -- 'fixup' commits should be squashed into the commit they fix up.

Custom rules

Custom rules may be provided in a validate-commits-config.toml file. Rules must be provided as a regular expression pattern and an error message and will be checked against the designated target.

Commit summary

Checks for the commit summary (the first line of the commit message) may be defined in a [[checks.summary]] table, e.g:

[[checks.summary]]
pattern = '\d'
message = "Numbers in commit summary."

Author email

Checks for author and co-author email addresses may be defined in a [[checks.author_email]] table, e.g:

[[checks.author_email]]
pattern = '@example\.(com|net|org)$'
message = "Fake email address provided."

pre-commit

A pre-push hook is provided for pre-commit and can be configured in your .pre-commit-config.yaml:

default_install_hook_types: [pre-commit, pre-push]
default_stages: [pre-commit]

repos:
    # ...
    - repo: https://github.com/samueljsb/validate-commits
      rev: v0.0.3
      hooks:
          - id: validate-commits

N.B. This hook only runs in the pre-push stage. Therefore, the pre-push hook must be installed, which may require pre-commit install to be run again. To ensure other hooks are not run unexpectedly during the pre-push stage, the default stage must be set at the top level.

Metadata

Release files for validate-commits 0.0.3

For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.

Source distribution (sdist)

Source distribution for validate-commits 0.0.3
File Size Uploaded Provenance
validate_commits-0.0.3.tar.gz 7.3 kB With provenance Details

Built distribution (wheel)

Table of built distributions (wheels) for validate-commits 0.0.3
File Interpreter ABI Platform
validate_commits-0.0.3-py3-none-any.whl Python 3 none any Details

Total release size: 15.9 kB

Release files / validate_commits-0.0.3.tar.gz

Download URL validate_commits-0.0.3.tar.gz
Size 7.3 kB
Tags Source
SHA-256 checksum
How to use checksums
919e5c2494c25c48e61f51d3570f34d45316884a62b3e5ddcceca34e8b3e301f
BLAKE2b-256 checksum
How to use checksums
f9dbf71ffc38b016f48387526c4ea4ad4a7b0a4b0007de39cf78f3d2fd92af8b
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.12

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 1, 2026.

Transparency log

Release files / validate_commits-0.0.3-py3-none-any.whl

Download URL validate_commits-0.0.3-py3-none-any.whl
Size 8.5 kB
Tags Python 3
SHA-256 checksum
How to use checksums
44801b699f3ea349682049a6bc80c506a3d51acecbdc4fe20ee27bb7afbdfbf1
BLAKE2b-256 checksum
How to use checksums
780d9ed1904ff08ab40c7ca228ce189a11ce1d62892de9f147a8467c3ad9aeb1
Upload date
Uploaded using Trusted Publishing?
What is trusted publishing?
Yes
Uploaded via twine/6.1.0 CPython/3.13.12

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 1, 2026.

Transparency log

Security for validate-commits 0.0.3

Provenance

Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.

Full provenance

All 2 files in this release have been uploaded with provenance metadata.

Select from 2 files

Attestation for validate_commits-0.0.3.tar.gz

PyPI Publish Attestation

PyPI verified that this artifact, at this checksum, originated from the publisher listed below.

Signed by GitHub Actions, verified by PyPI on Jun 1, 2026.

Transparency log

A note on package security

PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.

Anthropic, PBC Visionary sponsor Bloomberg Visionary sponsor Hudson River Trading Visionary sponsor Meta Visionary sponsor NVIDIA Visionary sponsor Microsoft Sustainability sponsor Depot Continuous Integration AWS Cloud computing and Security Sponsor Datadog Monitoring Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page