ci: call the shared workflows at one published reference and check PR titles

.github/dependabot.yml

@@ -25,7 +25,7 @@ updates:
       starters:
         patterns: ["*"]
     commit-message:
-      prefix: build
+      prefix: chore
       include: scope
 
   # Keep the workflows' actions current, one grouped pull request a week.
@@ -39,6 +39,11 @@ updates:
     groups:
       actions:
         patterns: ["*"]
+    # From v1.75.0 reviewdog/action-actionlint installs actionlint from a fork with `curl | bash`.
+    # actionlint.yml runs rhysd/actionlint's own release, checked by SHA-256, so this action is
+    # never proposed here.
+    ignore:
+      - dependency-name: "reviewdog/action-actionlint"
     commit-message:
-      prefix: ci
+      prefix: chore
       include: scope

.github/workflows/codeql.yml

@@ -1,7 +1,7 @@
 name: CodeQL
 
-# Static analysis through the shared CodeQL workflow, called the way the libraries call it, at one
-# published reference pinned by its commit SHA. Two languages: `javascript-typescript` for the
+# Static analysis through the shared CodeQL workflow, called the way the libraries call it, at the
+# published reference every Cosyte repository uses. Two languages: `javascript-typescript` for the
 # starters, and `actions` for the workflows under .github/workflows/, which run with this
 # repository's token.
 
@@ -27,6 +27,6 @@
       security-events: write # upload the SARIF to the Security tab
       contents: read
       actions: read
-    uses: cosyte/.github/.github/workflows/codeql.yml@6d0a8217760a8cf45f147376384962f031d92482 # workflows-2026-11-07-6d0a8217760a
+    uses: cosyte/.github/.github/workflows/codeql.yml@workflows-2026-11-07-498c7c13c886
     with:
       languages: '["actions", "javascript-typescript"]'

.github/workflows/pr-title.yml

@@ -0,0 +1,24 @@
+name: PR title
+
+# The pull request title must follow Conventional Commits: squash-merged, it is the commit that lands
+# on main. The rule lives in the shared workflow, called at the published reference every Cosyte
+# repository uses. Its one context is `pr-title / conventional-commits`.
+
+on:
+  pull_request:
+    branches: [main]
+    # `edited` is load-bearing: a title changed after the last push is the title that lands.
+    types: [opened, synchronize, reopened, edited]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  pr-title:
+    permissions:
+      contents: read
+    uses: cosyte/.github/.github/workflows/pr-title.yml@workflows-2026-11-07-498c7c13c886

.github/workflows/scorecard.yml

@@ -1,7 +1,7 @@
 name: Scorecard
 
 # OpenSSF Scorecard supply-chain analysis through the shared workflow, called the way the libraries
-# call it, at one published reference pinned by its commit SHA. It runs on main only: publishing the
+# call it, at the published reference every Cosyte repository uses. It runs on main only: publishing the
 # results needs the default branch.
 
 on:
@@ -20,4 +20,4 @@
       contents: read # required to resolve the reusable workflow (else contents:none and a startup failure)
       security-events: write # upload the SARIF to the Security tab
       id-token: write # publish results to the OpenSSF API (for the badge)
-    uses: cosyte/.github/.github/workflows/scorecard.yml@6d0a8217760a8cf45f147376384962f031d92482 # workflows-2026-11-07-6d0a8217760a
+    uses: cosyte/.github/.github/workflows/scorecard.yml@workflows-2026-11-07-498c7c13c886

CLAUDE.md

@@ -13,7 +13,8 @@ since a squash merge makes them the commit on `main`, and editing the title or b
 Steps 2 and 3 are `starters.yml`: every starter on Node 22 and 24, and `All starters` is the one
 check that stands for the whole matrix, so a new starter folder is tested with no workflow edit.
 `starters.yml` also runs nightly on `main`, from the lockfiles. Step 4 is `actionlint.yml`;
-`codeql.yml` and `scorecard.yml` call the shared workflows. A new starter also adds its folder to
+`codeql.yml`, `scorecard.yml`, and `pr-title.yml` (the PR title in Conventional Commits) call the
+shared workflows at one published `workflows-*` reference. A new starter also adds its folder to
 `.github/dependabot.yml`.
 
 ## Hazard: a starter gets copied into production