feat(engine): add commit-level evaluation primitives with ordered multi-commit support

[sachin9058]

Summary

This PR introduces commit-level evaluation primitives for pull request analysis, enabling evaluation of individual commits rather than only the final state (HEAD).

Currently, Minder evaluates only the resulting state of a PR, which can allow intermediate commits containing issues (e.g., vulnerable dependencies or invalid metadata) to be introduced into the repository history. This change provides a flexible foundation to support evaluation across all commits in a PR.

Key changes include:

• Added CommitPolicy interface for defining commit-level checks
• Implemented CommitEvaluator for evaluating commits against one or more policies
• Added EvaluateAll to evaluate all commits in a PR while preserving order
• Introduced CommitResult to capture structured per-commit evaluation results
• Added HasPolicyFailures helper for basic aggregation of results
• Retained HasFailures as a deprecated alias for backward compatibility
• Added ConventionalCommitPolicy as an example policy for commit message validation

This PR focuses on providing reusable evaluation primitives rather than enforcing specific policies. It enables building policies such as:

• Checking intermediate commit contents
• Enforcing commit message formats
• Validating commit metadata (e.g., signatures)

This builds on previous work:

• feat(engine): add commit iteration support for pull request evaluation #6372 (commit iteration support)
• test(engine): add unit tests for commit metadata extraction #6382 (commit metadata extraction tests)

Fixes #2176

Testing

The changes were tested using unit tests covering:

• Evaluation with no policies configured

• Evaluation with single and multiple policies

• Multi-commit evaluation using EvaluateAll

• Preservation of commit order in results

• Aggregation behavior using HasPolicyFailures

• Edge cases such as empty commit lists

• Validation of commit message formats using ConventionalCommitPolicy, including:

  • Valid conventional commits
  • Scopes with slashes (e.g., api/v1)
  • Uppercase scopes
  • Invalid commit messages

All tests were run using the existing Go test suite:

go test ./...

No additional configuration is required.

[coveralls]

coverage: 60.391% (+0.05%) from 60.337% — sachin9058:feat/commit-evaluation-primitives into mindersec:main

[sachin9058]

Hi all, just a quick follow-up happy to adjust the design or structure if needed.

In particular, I’d appreciate feedback on:

• Whether the CommitPolicy abstraction fits well with the existing engine
• How you’d like this integrated into the PR evaluation flow

Thanks!

@evankanderson