From 0500ebeb6d5169c2a7e509247ac574d21cfe4952 Mon Sep 17 00:00:00 2001
From: Andrew Thal <467872+athal7@users.noreply.github.com>
Date: Mon, 24 Aug 2026 10:44:41 -0500
Subject: [PATCH 1/2] fix(ci): enforce conventional commit format on pr titles
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Squash-merging PR #150 landed a security fix (docker filter injection
sanitization, alert-autofix-1) but used the PR's non-conventional
title as the squash commit subject. commit-analyzer only inspects
commit headers, so semantic-release found no releasable commit type
and silently skipped publishing — the fix is on main but was never
shipped to npm.

Add a PR-title lint (reused verbatim from opencode-pilot/opencode-cmd/kb)
that rejects non-Conventional-Commits titles at PR open/edit time, so
every future squash-merge commit is analyzable. This commit's own
fix: type also triggers the release semantic-release owes for #150.

Co-Authored-By: anthropic/claude-sonnet-5 <noreply@anthropic.com>
---
 .github/workflows/conventional-title.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 .github/workflows/conventional-title.yml

diff --git a/.github/workflows/conventional-title.yml b/.github/workflows/conventional-title.yml
new file mode 100644
index 0000000..d0baedd
--- /dev/null
+++ b/.github/workflows/conventional-title.yml
@@ -0,0 +1,22 @@
+name: conventional pull request title
+
+on:
+  pull_request:
+    types: [opened, edited, reopened, ready_for_review]
+
+permissions:
+  contents: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate title
+        env:
+          TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          if [[ "$TITLE" =~ ^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\([[:alnum:]_.\/-]+\))?!?:\ .+ ]]; then
+            exit 0
+          fi
+          printf 'Pull request titles must use Conventional Commits: %s\n' "$TITLE"
+          exit 1

From cc71da7203074dd4551261b57b7e76190e94bbb2 Mon Sep 17 00:00:00 2001
From: Andrew Thal <467872+athal7@users.noreply.github.com>
Date: Mon, 24 Aug 2026 10:58:37 -0500
Subject: [PATCH 2/2] fix(ci): run title validator from base branch on every
 push

Address CodeRabbit review on #152:
- Use pull_request_target so the check runs the workflow definition
  from main, not the PR branch (a PR can't edit/remove its own title
  check). Safe here since this workflow never checks out PR code.
- Add synchronize so the check re-validates on every new commit
  instead of leaving a stale result on the initial commit SHA.

Co-Authored-By: anthropic/claude-sonnet-5 <noreply@anthropic.com>
---
 .github/workflows/conventional-title.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.github/workflows/conventional-title.yml b/.github/workflows/conventional-title.yml
index d0baedd..eb9ca8a 100644
--- a/.github/workflows/conventional-title.yml
+++ b/.github/workflows/conventional-title.yml
@@ -1,8 +1,8 @@
 name: conventional pull request title
 
 on:
-  pull_request:
-    types: [opened, edited, reopened, ready_for_review]
+  pull_request_target:
+    types: [opened, edited, reopened, ready_for_review, synchronize]
 
 permissions:
   contents: read