Skip to content
Back to skills

Commitlint

ASecurity

commitlint checks that Git commit messages follow the Conventional Commits format (type(scope): subject) and fails when they do not. Use when a user asks to standardize commit messages, enforce commit conventions with a husky commit-msg hook, lint commits or PR commits in CI, customize rules, or prepare commits for automated changelogs and semantic versioning.

  • 142 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added May 27, 2026
developmentjavascriptgojavabashnodegitapi

Works with

  • terminal
  • cli
  • api

Security analysis

A96/100
  • mediumInstalls packages at runtime which could introduce malicious dependencies

Pro scans all 2 files and shows the line behind each finding

Scanned October 4, 2026

npx -y skills add TerminalSkills/skills --skill commitlint --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Commitlint?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Commitlint
[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/terminalskills-commitlint/badge)](https://www.skillsdirectory.com/skills/terminalskills-commitlint)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
---
name: commitlint
description: >-
  commitlint checks that Git commit messages follow the Conventional Commits format (type(scope): subject) and fails when they do not. Use when a user asks to standardize commit messages, enforce commit conventions with a husky commit-msg hook, lint commits or PR commits in CI, customize rules, or prepare commits for automated changelogs and semantic versioning.
license: Apache-2.0
compatibility: "Node.js 22.12 or newer, git 2.13.2 or newer, any Git repository"
metadata:
  author: terminal-skills
  version: "1.1.0"
  category: development
  repository: https://github.com/conventional-changelog/commitlint
  tags:
    - commitlint
    - git
    - conventional-commits
    - ci
    - changelog
---

# commitlint

## Overview

commitlint (`@commitlint/cli`, v21 at the time of writing) lints a commit message against a rule set; the usual rule set is `@commitlint/config-conventional`, which enforces `type(scope?): subject`. It requires Node.js 22.12 or newer. It runs in a Git `commit-msg` hook (typically via husky) and in CI. Valid messages let tools such as semantic-release, release-please, changesets or conventional-changelog derive version bumps and changelogs.

## Instructions

### Step 1: Install and add the hook (husky v9)

```bash
npm install -D @commitlint/cli @commitlint/config-conventional husky
npx husky init
echo 'npx --no -- commitlint --edit "$1"' > .husky/commit-msg
```

`npx husky init` also creates `.husky/pre-commit` containing `npm test`, which makes every commit fail in a project without tests. Edit or empty that file if you do not want it.

### Step 2: Configure

Create `commitlint.config.mjs` (or `commitlint.config.js` with `"type": "module"`, `.cjs`, `.ts`, `.commitlintrc.*`, or a `commitlint` key in `package.json`).

```javascript
// commitlint.config.mjs
export default {
  extends: ['@commitlint/config-conventional'],
  rules: {
    // [severity, applicable, value]; severity 0 off, 1 warning, 2 error
    'scope-enum': [2, 'always', ['auth', 'api', 'billing', 'ui', 'deps']],
    'scope-case': [2, 'always', 'kebab-case'],
    'header-max-length': [2, 'always', 72],
  },
}
```

The default `type-enum` is build, chore, ci, docs, feat, fix, perf, refactor, revert, style, test. If you override `type-enum`, repeat the types you still want, including `revert`. Default config-conventional limits headers and body/footer lines to 100 characters and forbids sentence-case subjects and trailing periods.

### Step 3: Try it

```bash
echo "updated stuff" | npx commitlint          # exit 1: subject and type may not be empty
echo "feat(auth): add Google OAuth login" | npx commitlint   # exit 0
git commit -m "fix(api): handle null response from /users"   # hook runs commitlint
```

### Step 4: Lint in CI

```yaml
# .github/workflows/commitlint.yml
name: commitlint
on: [pull_request]
jobs:
  commitlint:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-node@v4
        with:
          node-version: 22
      - run: npm ci
      - run: npx commitlint --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
```

Other useful forms: `npx commitlint --last` (latest commit), `--from origin/main` (everything since main), `--config path` for a non-default config. If you squash-merge, lint the PR title instead of the individual commits.

## Examples

### Example 1: Add commit linting to an existing repo

**User request:** "Make everyone on the team use conventional commits."

Run Step 1 and Step 2, empty `.husky/pre-commit` if the repo has no `npm test`, and commit `commitlint.config.mjs` and `.husky/`. Then `git commit -m "updated stuff"` is rejected with `type may not be empty [type-empty]`, and `git commit -m "feat(billing): add annual plan"` succeeds. Add a `prepare` script (`"prepare": "husky"`, which `husky init` sets) so teammates get hooks after `npm install`.

### Example 2: Restrict scopes to the monorepo packages

**User request:** "Only allow scopes that match our package names."

Set `'scope-enum': [2, 'always', ['web', 'api', 'worker']]`. Then `echo "feat(mobile): add push" | npx commitlint` exits 1 with `scope must be one of [web, api, worker] [scope-enum]`, while `fix(api): retry on 503` passes.

## Guidelines

- Hooks can be bypassed with `git commit --no-verify`; keep the CI check as the enforcement point.
- Merge and revert commits generated by Git are ignored by default; do not disable that.
- `subject-max-length` does not exist in config-conventional by default; the header limit is `header-max-length` (100).
- Breaking changes use `feat!:` or a `BREAKING CHANGE:` footer and map to a major version; `feat` maps to minor, `fix` to patch.
- commitlint only lints messages; it does not generate changelogs. Pair it with a release tool.
- On older Node versions install an older commitlint major; v21 needs Node 22.12 or newer.

Files in this skill

  • SKILL.md1.7 KB
  • _scores.json1.3 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments

Loading comments…