From 1b6d828dff86d8ea78197bc123f22616aebe9671 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 6 Jul 2026 11:27:07 +0000
Subject: [PATCH 1/4] ci: add PR title lint workflow

Enforce conventional commit PR titles via ossprey/cicd/pr-lint on
opened, edited and reopened pull request events.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0126vwoz9uFAw2GHZWNABAWX
---
 .github/workflows/pr-lint.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)
 create mode 100644 .github/workflows/pr-lint.yml

diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
new file mode 100644
index 0000000..922693f
--- /dev/null
+++ b/.github/workflows/pr-lint.yml
@@ -0,0 +1,13 @@
+name: PR Lint
+
+on:
+  pull_request:
+    types: [opened, edited, reopened]
+
+jobs:
+  lint-title:
+    runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'self-hosted' }}
+    steps:
+      - uses: ossprey/cicd/pr-lint@main
+        with:
+          pr-title: ${{ github.event.pull_request.title }}

From c4ee142309c49976534dcb2347bc8df9ae079545 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 10 Jul 2026 09:12:45 +0000
Subject: [PATCH 2/4] fix: use public action for PR title lint

---
 .github/workflows/pr-lint.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
index 922693f..3a28dec 100644
--- a/.github/workflows/pr-lint.yml
+++ b/.github/workflows/pr-lint.yml
@@ -8,6 +8,6 @@ jobs:
   lint-title:
     runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'self-hosted' }}
     steps:
-      - uses: ossprey/cicd/pr-lint@main
-        with:
-          pr-title: ${{ github.event.pull_request.title }}
+      - uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

From c0f213da7c11c32e44015c93ef84173faf9699ad Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 10 Jul 2026 09:13:37 +0000
Subject: [PATCH 3/4] chore: scope lint-title workflow token permissions

---
 .github/workflows/pr-lint.yml | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
index 3a28dec..dd15452 100644
--- a/.github/workflows/pr-lint.yml
+++ b/.github/workflows/pr-lint.yml
@@ -7,6 +7,8 @@ on:
 jobs:
   lint-title:
     runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'self-hosted' }}
+    permissions:
+      pull-requests: read
     steps:
       - uses: amannn/action-semantic-pull-request@v5
         env:

From 3135b2ed256e992e7a32b20d1f5c8a63d3ef67a6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 10 Jul 2026 09:50:39 +0000
Subject: [PATCH 4/4] fix: lint PR titles inline without external action

Replace the third-party amannn/action-semantic-pull-request@v5 action,
which was handed secrets.GITHUB_TOKEN, with an inline shell check that
validates the PR title against Conventional Commits using the event
payload. This addresses the review concern about exposing our GitHub
token to an external action.

- No external action and no token are used; the PR title is read from
  github.event.pull_request.title.
- The title is passed via an env var (not interpolated into the script)
  to avoid shell injection.
- permissions is set to {} since no API access is required.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01KtGBySiTPMbsJKPYb7zYYj
---
 .github/workflows/pr-lint.yml | 17 +++++++++++++----
 1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
index dd15452..f891332 100644
--- a/.github/workflows/pr-lint.yml
+++ b/.github/workflows/pr-lint.yml
@@ -4,12 +4,21 @@ on:
   pull_request:
     types: [opened, edited, reopened]
 
+permissions: {}
+
 jobs:
   lint-title:
     runs-on: ${{ github.server_url == 'https://github.com' && 'ubuntu-latest' || 'self-hosted' }}
-    permissions:
-      pull-requests: read
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - name: Validate PR title follows Conventional Commits
         env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          pattern='^(build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)(\(.+\))?!?: .+'
+          if [[ ! "$PR_TITLE" =~ $pattern ]]; then
+            echo "::error::PR title \"$PR_TITLE\" does not follow Conventional Commits."
+            echo "Expected format: <type>(optional scope): <description>"
+            echo "Allowed types: build, chore, ci, docs, feat, fix, perf, refactor, revert, style, test"
+            exit 1
+          fi
+          echo "PR title \"$PR_TITLE\" follows Conventional Commits."