Validate Commits
Validate commit messages and metadata.
Usage
$ validate-commits --help
usage: validate-commits [-h] [--since SINCE]
options:
-h, --help show this help message and exit
--since SINCE check commits since this reference
The tool will check all commits
between main and the current HEAD.
Checks
Built-in rules
There are several built-in rules, which are checked automatically:
- "Commit author has no email"
-- all commits must have an author email
and all co-authors (in
Co-authored-bytrailers) must have an email. - "Commit is empty" -- empty commits are not allowed.
- "Fixup commit" -- 'fixup' commits should be squashed into the commit they fix up.
Custom rules
Custom rules may be provided in a validate-commits-config.toml file.
Rules must be provided as a regular expression pattern and an error message
and will be checked against the designated target.
Commit summary
Checks for the commit summary (the first line of the commit message)
may be defined in a [[checks.summary]] table,
e.g:
[[checks.summary]]
pattern = '\d'
message = "Numbers in commit summary."
Author email
Checks for author and co-author email addresses
may be defined in a [[checks.author_email]] table,
e.g:
[[checks.author_email]]
pattern = '@example\.(com|net|org)$'
message = "Fake email address provided."
pre-commit
A pre-push hook is provided for pre-commit
and can be configured in your .pre-commit-config.yaml:
default_install_hook_types: [pre-commit, pre-push]
default_stages: [pre-commit]
repos:
# ...
- repo: https://github.com/samueljsb/validate-commits
rev: v0.0.3
hooks:
- id: validate-commits
N.B. This hook only runs in the pre-push stage.
Therefore, the pre-push hook must be installed,
which may require pre-commit install to be run again.
To ensure other hooks are not run unexpectedly during the pre-push stage,
the default stage must be set at the top level.
Metadata
Release files for validate-commits 0.0.3
For a detailed explanation of source distributions (sdists) and built distributions (wheels), please see the package formats documentation.
Source distribution (sdist)
| File | Size | Uploaded | Provenance | |
|---|---|---|---|---|
| validate_commits-0.0.3.tar.gz | 7.3 kB | With provenance | Details |
Built distribution (wheel)
| File | Interpreter | ABI | Platform | Reset |
|---|---|---|---|---|
| validate_commits-0.0.3-py3-none-any.whl | Python 3 | none | any | Details |
Total release size: 15.9 kB
Release files / validate_commits-0.0.3.tar.gz
| Download URL | validate_commits-0.0.3.tar.gz |
|---|---|
| Size | 7.3 kB |
| Tags | Source |
|
SHA-256 checksum How to use checksums |
919e5c2494c25c48e61f51d3570f34d45316884a62b3e5ddcceca34e8b3e301f
|
|
BLAKE2b-256 checksum How to use checksums |
f9dbf71ffc38b016f48387526c4ea4ad4a7b0a4b0007de39cf78f3d2fd92af8b
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 1, 2026.
Transparency logRelease files / validate_commits-0.0.3-py3-none-any.whl
| Download URL | validate_commits-0.0.3-py3-none-any.whl |
|---|---|
| Size | 8.5 kB |
| Tags | Python 3 |
|
SHA-256 checksum How to use checksums |
44801b699f3ea349682049a6bc80c506a3d51acecbdc4fe20ee27bb7afbdfbf1
|
|
BLAKE2b-256 checksum How to use checksums |
780d9ed1904ff08ab40c7ca228ce189a11ce1d62892de9f147a8467c3ad9aeb1
|
| Upload date | |
|
Uploaded using Trusted Publishing? What is trusted publishing? |
Yes |
| Uploaded via |
twine/6.1.0 CPython/3.13.12
|
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 1, 2026.
Transparency logSecurity for validate-commits 0.0.3
Provenance
Provenance describes where a file came from. On PyPI, provenance is shared via attestations, which provide a verifiable record of the build or publishing details. View details, limitations and caveats.
Full provenance
All 2 files in this release have been uploaded with provenance metadata.
Attestation for validate_commits-0.0.3.tar.gz
PyPI Publish Attestation
PyPI verified that this artifact, at this checksum, originated from the publisher listed below.
Signed by GitHub Actions, verified by PyPI on Jun 1, 2026.
Transparency logA note on package security
PyPI is a repository for distributing packages, not a service for auditing them. While third-party security researchers and our staff do their best to detect and remove malicious packages, PyPI cannot guarantee the quality, security or suitability of any given package.