From d206d28f1c1ef21dae9d56a0cda454b68957aa83 Mon Sep 17 00:00:00 2001
From: Vito Albano <vito.albano@alfresco.com>
Date: Mon, 1 Jun 2026 09:47:45 +0100
Subject: [PATCH] [AAE-32905] Fix commit messages commands aren't working
 (#11922)

* [ci:force] - Checking

* [AAE-32905] - Re enabled ci commands on commit messages

* [ci:force] - Checking
---
 .github/actions/before-install/action.yml | 18 ++++++++++++++---
 .github/workflows/pull-request.yml        | 24 ++++++++++++++++++++---
 docs/ci-commands.md                       |  3 ++-
 3 files changed, 38 insertions(+), 7 deletions(-)

diff --git a/.github/actions/before-install/action.yml b/.github/actions/before-install/action.yml
index 15a8ba7099..9aa3cd34f3 100644
--- a/.github/actions/before-install/action.yml
+++ b/.github/actions/before-install/action.yml
@@ -25,10 +25,22 @@ runs:
 
     - name: affected:* flag parser
       shell: bash
-      if: ${{ contains(github.event.head_commit.message , '[affected:*]') }}
+      env:
+        EVENT_NAME: ${{ github.event_name }}
+        PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
       run: |
-        echo "Setting up CI to run with commit flag [affected:*] flag."
-        echo "BREAK_ACTION=true" >> $GITHUB_ENV
+        # Get commit message safely from git to avoid script injection
+        # For PRs, use the PR head SHA; for other events use HEAD
+        if [ "$EVENT_NAME" == "pull_request" ] && [ -n "$PR_HEAD_SHA" ]; then
+          COMMIT_MSG=$(git log -1 --format=%B "$PR_HEAD_SHA" 2>/dev/null || echo "")
+        else
+          COMMIT_MSG=$(git log -1 --format=%B 2>/dev/null || echo "")
+        fi
+
+        if echo "$COMMIT_MSG" | grep -qF "[affected:*]"; then
+          echo "Setting up CI to run with commit flag [affected:*] flag."
+          echo "BREAK_ACTION=true" >> $GITHUB_ENV
+        fi
 
     - name: PULL_REQUEST event
       if: ${{ env.BREAK_ACTION == false && github.event_name == 'pull_request' && !github.event.pull_request.merged }}
diff --git a/.github/workflows/pull-request.yml b/.github/workflows/pull-request.yml
index b5ea0d330e..09d12fc54e 100644
--- a/.github/workflows/pull-request.yml
+++ b/.github/workflows/pull-request.yml
@@ -86,24 +86,42 @@ jobs:
   check-if-pr-is-approved:
     runs-on: ubuntu-latest
     steps:
+      - name: Checkout repository
+        if: ${{ github.event_name == 'pull_request' }}
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.head.sha }}
+          fetch-depth: 1
+
       - name: Check if PR approval can be skipped
         id: skip-check
         env:
           EVENT_NAME: ${{ github.event_name }}
           ACTOR: ${{ github.actor }}
           DEVEL_FLAG: ${{ inputs.devel }}
-          COMMIT_MESSAGE: ${{ github.event.head_commit.message || github.event.pull_request.title || '' }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+          PR_HEAD_SHA: ${{ github.event.pull_request.head.sha }}
         run: |
           skip="false"
 
+          # Get commit message safely from git to avoid script injection
+          if [ "$EVENT_NAME" == "pull_request" ] && [ -n "$PR_HEAD_SHA" ]; then
+            COMMIT_MESSAGE=$(git log -1 --format=%B "$PR_HEAD_SHA" 2>/dev/null || echo "")
+          else
+            COMMIT_MESSAGE=$(git log -1 --format=%B 2>/dev/null || echo "")
+          fi
+
           if [ "$EVENT_NAME" == "schedule" ] || [ "$EVENT_NAME" == "workflow_dispatch" ]; then
             echo -e "\033[32mSchedule/dispatch event — skipping approval check\033[0m"
             skip="true"
           elif [ "$ACTOR" == "dependabot[bot]" ] || [ "$ACTOR" == "alfresco-build" ]; then
             echo -e "\033[32mCommit by $ACTOR — skipping approval check\033[0m"
             skip="true"
-          elif [[ "$COMMIT_MESSAGE" == *"[ci:force]"* ]]; then
-            echo -e "\033[32m[ci:force] flag detected — skipping approval check\033[0m"
+          elif echo "$PR_TITLE" | grep -qF "[ci:force]"; then
+            echo -e "\033[32m[ci:force] flag detected in PR title — skipping approval check\033[0m"
+            skip="true"
+          elif echo "$COMMIT_MESSAGE" | grep -qF "[ci:force]"; then
+            echo -e "\033[32m[ci:force] flag detected in commit message — skipping approval check\033[0m"
             skip="true"
           elif [[ "$DEVEL_FLAG" == "true" ]]; then
             echo -e "\033[32mDevel flag — skipping approval check\033[0m"
diff --git a/docs/ci-commands.md b/docs/ci-commands.md
index dff544c7d3..303bd802c6 100644
--- a/docs/ci-commands.md
+++ b/docs/ci-commands.md
@@ -14,10 +14,11 @@ Example: `[AAE-12345] Fix pagination component [ci:force]`
 
 ## Commit Message Flags
 
-Include these flags in a **commit message** to modify how Nx calculates affected projects.
+Include these flags in a **commit message** to modify CI behavior.
 
 | Flag | Effect |
 |------|--------|
+| `[ci:force]` | Skips the PR approval check (same as PR title flag). |
 | `[affected:*]` | Forces all Nx targets to run against all projects, ignoring the affected calculation. Equivalent to `--all`. |
 
 ## PR Labels