[ot] scripts/opentitan: lint-commits: lint commits in CI

Signed-off-by: James Wainwright <james.wainwright@lowrisc.org>

Author: jwnrt

.github/workflows/build_test.yaml

@@ -121,6 +121,17 @@ jobs:
         run: |
           scripts/opentitan/ot-tidy.sh --ci -p build-clang
 
+  lint-commits:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0 # Don't shallow clone, we need to see all commits.
+      - name: Create local branch
+        run: git branch "${{ github.base_ref }}" "origin/${{ github.base_ref }}"
+      - name: Lint commits
+        run: ./scripts/opentitan/lint-commits.sh
+
   test-clang:
     runs-on: ubuntu-24.04
     needs: build-clang

scripts/opentitan/lint-commits.sh

@@ -0,0 +1,80 @@
+#!/usr/bin/env sh
+# Copyright lowRISC.
+
+# This script checks that commit messages are in the correct format:
+#
+#   1. The title must be of the form `[ot] path/to/change: description`.
+#   2. The message must end with `Signed-off-by: Name <email@address>`.
+#
+# It is intended to be run from CI, however you can run it manually with:
+#
+#   GITHUB_BASE_REF="HEAD~5" lint-commits.sh
+#
+# Where `GITHUB_BASE_REF` is the first commit to start linting from.
+
+set -e
+
+# Check the commit title has the correct prefixes.
+lint_title() {
+  commit="$1"
+
+  title="$(git show "$commit" -s --format="format:%s")"
+  short_hash="$(git show "$commit" -s --format="format:%h")"
+
+  example() {
+    echo "Got:"                                                     >&2
+    echo "    ${title}"                                             >&2
+    echo
+    echo "Example:"                                                 >&2
+    echo "    [ot] hw/opentitan: ot_hmac: fix i2c register address" >&2
+  }
+
+  if ! echo "$title" | grep -P -q '^\[ot\]'; then
+    echo "::error::${short_hash}: commit titles must have the prefix '[ot]'" >&2
+    example
+    exit 1
+  fi
+
+  if ! echo "$title" | grep -P -q '^\[ot\]\s+[^:]+:'; then
+    echo "::error::${short_hash}: commit titles must contain the path of the change" >&2
+    example
+    exit 1
+  fi
+
+  if ! echo "$title" | grep -P -q '^\[ot\]\s+[^:]+:\s+[^:]+:'; then
+    echo "::error::${short_hash}: commit titles must state the changed component" >&2
+    example
+    exit 1
+  fi
+}
+
+# Check the commit is signed off.
+lint_signed_off_by() {
+  commit="$1"
+
+  signed_off_by="$(git show "$commit" -s --format="format:%(trailers:key=Signed-off-by)")"
+  short_hash="$(git show "$commit" -s --format="format:%h")"
+
+  if [ -z "$signed_off_by" ]; then
+    echo "::error::${short_hash}: is missing a 'Signed-off-by' line" >&2
+    echo "Hint:"                                                     >&2
+    echo "Use \`git commit -s\` to add sign-offs"                    >&2
+    exit 1
+  fi
+}
+
+if [ -z "$GITHUB_BASE_REF" ]; then
+  echo "ERROR: This script is intended to be run in CI."                                            >&2
+  echo "If you'd like to run it locally, set \`GITHUB_BASE_REF\` to the first commit to lint from." >&2
+  exit 1
+fi
+
+exit_code=0
+
+# Lint each commit from the merge target to now.
+for commit in $(git log "${GITHUB_BASE_REF}..HEAD" --format="format:%H" --no-merges); do
+  lint_title "$commit"         || exit_code=1
+  lint_signed_off_by "$commit" || exit_code=1
+done
+
+exit $exit_code