ci: enforce Conventional Commits on PR title instead of commits

[Roboroads]

What

Switches PR compliance from checking individual commit messages to checking the PR title, and removes the now-redundant local commitlint setup.

• Add a check-pr-title job that validates the PR title against Conventional Commits and reports into the existing auto-updating compliance comment
• Remove the per-commit check-conventional-commits job
• Delete the local husky commit-msg hook, commitlint.config.cjs, and the @commitlint/* devDeps (purged from the lockfile too)
• Document the protected-main / squash-merge / PR-title workflow in CONTRIBUTING.md and correct the pnpm version prerequisite

Why

Every PR is squash-merged, so the PR title becomes the squash commit message and the changelog source — that's what must follow Conventional Commits. The individual branch commits are discarded on squash, so enforcing the format on them (both in CI and via the local husky hook) was redundant friction with no effect on what lands on main.

Pairs with the repo settings now in place: squash-only merges, protected main, and the squash default message set to the PR title.

AI disclosure

Authored with assistance from Claude Code; everything is human-reviewed by me, and the type-check (pnpm check) passed locally.

Summary by CodeRabbit

• Chores

  • CI now checks PR titles for Conventional Commits instead of validating individual commit messages.
  • Removed local commit-message validation tooling and related dev dependencies.

• Documentation

  • Updated contributing guide to require pnpm 11+ and to require Conventional Commits-formatted PR titles while noting commits in squash-merged PRs need not follow the convention.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 037962f3-9560-499c-b2a0-2473002b4cf8

📥 Commits

Reviewing files that changed from the base of the PR and between 54d4d11 and eb6261d.

📒 Files selected for processing (1)

• CONTRIBUTING.md

✅ Files skipped from review due to trivial changes (1)

• CONTRIBUTING.md

---

📝 Walkthrough

Walkthrough

Migrates from local commit-message validation to a GitHub Actions check-pr-title job that validates PR titles against Conventional Commits; updates the report job, removes commitlint devDependencies, and updates CONTRIBUTING to require pnpm 11+ and document PR title requirements.

Changes

PR Title Validation Workflow

Layer / File(s)	Summary
PR title validation job and reporting integration .github/workflows/pr-compliance.yml	New check-pr-title job fetches the PR, validates the title with a Conventional Commits regex, and outputs passed and detail. The report job now depends on check-pr-title (replacing check-conventional-commits) and aggregates PR title compliance failures using TITLE_PASSED and TITLE_DETAIL.
Dependency cleanup and commitlint removal package.json	Removes @commitlint/cli and @commitlint/config-conventional from devDependencies.
Contributing guide and pnpm version update CONTRIBUTING.md	Updates pnpm prerequisite to 11 or later and reworks "Submitting Changes" to require PR titles follow Conventional Commits with allowed types (feat, fix, chore, docs, style, refactor, test, build, ci, perf, revert); clarifies branch commit messages are not validated.

🎯 2 (Simple) | ⏱️ ~12 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The PR title 'ci: enforce Conventional Commits on PR title instead of commits' directly and clearly describes the main change: shifting Conventional Commits enforcement from individual commits to PR titles in the CI workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (1)

.github/workflows/pr-compliance.yml (1)

30-38: ⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Pin actions/github-script to a full commit SHA (not @v7).

.github/workflows/pr-compliance.yml references uses: actions/github-script@v7 at lines 17, 37, 71, and 117; replace @v7 with the exact 40-character commit SHA to reduce supply-chain risk in pull_request_target.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pr-compliance.yml around lines 30 - 38, Replace the
floating tag for the GitHub Action with a pinned commit SHA: locate the workflow
job "check-pr-title" (and other jobs/steps using actions/github-script, e.g.,
the step with id "check") and change every uses: actions/github-script@v7 to
uses: actions/github-script@<40-char-commit-sha> (the exact full commit SHA from
the actions/github-script repository) so the workflow references a specific
immutable commit instead of the v7 tag.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@CONTRIBUTING.md`:
- Around line 66-70: The fenced code block containing the commit examples is
missing a language identifier which triggers MD040; update the triple-backtick
fence that wraps the three lines ("feat: add crossfade support", "fix(ipc):
handle null device on reconnect", "chore!: drop support for Node 22") to include
a language tag (e.g., change ``` to ```text) so the block becomes ```text ...
``` for proper markdownlint compliance.

---

Outside diff comments:
In @.github/workflows/pr-compliance.yml:
- Around line 30-38: Replace the floating tag for the GitHub Action with a
pinned commit SHA: locate the workflow job "check-pr-title" (and other
jobs/steps using actions/github-script, e.g., the step with id "check") and
change every uses: actions/github-script@v7 to uses:
actions/github-script@<40-char-commit-sha> (the exact full commit SHA from the
actions/github-script repository) so the workflow references a specific
immutable commit instead of the v7 tag.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: c3c46a16-874e-4ad1-9193-806c29634568

📥 Commits

Reviewing files that changed from the base of the PR and between 345bf30 and 54d4d11.

⛔ Files ignored due to path filters (1)

• pnpm-lock.yaml is excluded by !**/pnpm-lock.yaml

📒 Files selected for processing (5)

• .github/workflows/pr-compliance.yml
• .husky/commit-msg
• CONTRIBUTING.md
• commitlint.config.cjs
• package.json

💤 Files with no reviewable changes (3)

• .husky/commit-msg
• commitlint.config.cjs
• package.json

[github-actions]

✅ All compliance checks are now passing — thanks for updating your PR!