ci: lint PR conventions and polish CI workflows

.commitlintrc.json

@@ -0,0 +1,3 @@
+{
+  "extends": ["@commitlint/config-conventional"]
+}

.github/workflows/build.yml

@@ -178,6 +178,11 @@ jobs:
         with:
           bun-version: "1.3.11"
 
+      # Load-bearing: `bun install` runs `trustedDependencies`
+      # postinstalls from the root package.json (electron, node-pty,
+      # esbuild, tree-sitter at time of writing), which call `node`
+      # explicitly. Do not drop without first patching those scripts.
+      # Source of truth: grep `trustedDependencies` in package.json. (#70)
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f
         with:
           node-version: "24"

.github/workflows/ci.yml

@@ -96,6 +96,11 @@ jobs:
         with:
           persist-credentials: false
 
+      # Load-bearing: `bun install` runs `trustedDependencies`
+      # postinstalls from the root package.json (electron, node-pty,
+      # esbuild, tree-sitter at time of writing), which call `node`
+      # explicitly. Do not drop without first patching those scripts.
+      # Source of truth: grep `trustedDependencies` in package.json. (#70)
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # actions/setup-node@v6.3.0
         with:
           node-version: "24"
@@ -137,6 +142,11 @@ jobs:
         with:
           persist-credentials: false
 
+      # Load-bearing: `bun install` runs `trustedDependencies`
+      # postinstalls from the root package.json (electron, node-pty,
+      # esbuild, tree-sitter at time of writing), which call `node`
+      # explicitly. Do not drop without first patching those scripts.
+      # Source of truth: grep `trustedDependencies` in package.json. (#70)
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # actions/setup-node@v6.3.0
         with:
           node-version: "24"

.github/workflows/commit-lint.yml

@@ -0,0 +1,31 @@
+# Advisory check: lint commit messages on the PR against Conventional
+# Commits. Pairs with pr-title-lint.yml -- catches intermediate commits
+# that the PR title check cannot see. Not required in the `dev`
+# ruleset. (#69)
+name: commit-lint
+
+on:
+  pull_request:
+    branches: [dev]
+
+concurrency:
+  group: commit-lint-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  lint-commits:
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # actions/checkout@v6
+        with:
+          fetch-depth: 0
+          persist-credentials: false
+
+      - uses: wagoid/commitlint-github-action@6cf16efdf4da5277c791d335142c03a0bdf1766e # wagoid/commitlint-github-action@v6.2.1
+        with:
+          configFile: .commitlintrc.json

.github/workflows/dependency-review.yml

@@ -10,7 +10,7 @@ concurrency:
 
 permissions:
   contents: read
-  pull-requests: write
+  pull-requests: read
 
 jobs:
   review:
@@ -21,21 +21,13 @@ jobs:
         with:
           persist-credentials: false
 
-      # Non-blocking during the initial rollout: `warn-only` makes policy
-      # findings (CVEs, license violations) surface as a comment without
-      # failing the job, while still failing loudly on action-level
-      # misconfiguration (auth, parser, network). GitHub supports bun.lock
-      # directly, but the `catalog:` field and workspace resolution are the
-      # real unknowns on this repo. Once a PR run shows the dep graph is
-      # parsed correctly, drop warn-only, set fail-on-severity: high, and
-      # add this job to the dev ruleset. Tracked in #54.
-      #
-      # Skipped on fork PRs: GITHUB_TOKEN is read-only, so the
-      # comment-summary-in-pr write would fail or silently no-op under
-      # warn-only. Mirrors the fork guard on the junit publisher in ci.yml.
-      - if: >
-          github.event.pull_request.head.repo.full_name == github.repository
-        uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # actions/dependency-review-action@v4.9.0
+      # Advisory check: `warn-only: true` surfaces CVE/license findings
+      # in the Actions log but never fails the PR. Paired with `never`
+      # for comment-summary-in-pr so the action needs no write access
+      # and runs on fork PRs too (exactly where advisory coverage is
+      # most useful). Upgrading to fail-on-severity: high is a separate
+      # decision.
+      - uses: actions/dependency-review-action@2031cfc080254a8a887f58cffee85186f0e49e48 # actions/dependency-review-action@v4.9.0
         with:
-          comment-summary-in-pr: always
+          comment-summary-in-pr: never
           warn-only: true

.github/workflows/desktop-smoke.yml

@@ -96,6 +96,11 @@ jobs:
         with:
           persist-credentials: false
 
+      # Load-bearing: `bun install` runs `trustedDependencies`
+      # postinstalls from the root package.json (electron, node-pty,
+      # esbuild, tree-sitter at time of writing), which call `node`
+      # explicitly. Do not drop without first patching those scripts.
+      # Source of truth: grep `trustedDependencies` in package.json. (#70)
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # actions/setup-node@v6.3.0
         with:
           node-version: "24"

.github/workflows/e2e-artifacts.yml

@@ -40,6 +40,11 @@ jobs:
         with:
           persist-credentials: false
 
+      # Load-bearing: `bun install` runs `trustedDependencies`
+      # postinstalls from the root package.json (electron, node-pty,
+      # esbuild, tree-sitter at time of writing), which call `node`
+      # explicitly. Do not drop without first patching those scripts.
+      # Source of truth: grep `trustedDependencies` in package.json. (#70)
       - uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # actions/setup-node@v6.3.0
         with:
           node-version: "24"

.github/workflows/pr-title-lint.yml

@@ -0,0 +1,48 @@
+# Advisory check: lint PR titles against Conventional Commits. Catches
+# drift early so PR titles read consistently in listings and serve as a
+# well-formed subject when a PR is squash-merged (this repo normally
+# uses merge commits, so the PR title is not the commit subject on
+# `dev`, but the convention still matters for review hygiene). Not
+# required in the `dev` ruleset -- failures flag the PR but do not
+# block merge. Draft PRs with `WIP:` prefix are skipped. (#68)
+name: pr-title-lint
+
+on:
+  pull_request_target:
+    types: [opened, edited, reopened, ready_for_review]
+    branches: [dev]
+
+concurrency:
+  group: pr-title-lint-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+  pull-requests: read
+
+jobs:
+  lint-pr-title:
+    runs-on: ubuntu-latest
+    timeout-minutes: 3
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # amannn/action-semantic-pull-request@v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            refactor
+            docs
+            chore
+            ci
+            build
+            perf
+            test
+            style
+            revert
+          requireScope: false
+          subjectPattern: ^\S.{2,}$
+          subjectPatternError: |
+            The subject after `type:` must be at least 3 characters and start with a non-space character.
+          wip: true