@avi2dg/checks 0.67.0 → 0.68.1

package/CHANGELOG.md

@@ -2,6 +2,22 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.68.1
+
+Released 2026-11-06.
+
+### Fixes
+
+- **commitlint:** accept Dependabot titles that open with Bump or Update [#50](https://github.com/avi2d/checks/pull/50)
+
+## 0.68.0
+
+Released 2026-11-06.
+
+### Features
+
+- **ci-wiring:** accept short shared refs for runner pick and setup [#49](https://github.com/avi2d/checks/pull/49)
+
 ## 0.67.0
 
 Released 2026-11-06.

package/commitlint.config.ts

@@ -1,3 +1,20 @@
+// subject-case cannot be relaxed for one author, so every rule skips the title shapes Dependabot writes.
+const token = String.raw`\S*[^\s.]`;
+const directory = String.raw`in \/\S*[^\s.]`;
+const group = String.raw`[\w.-]+`;
+const single = String.raw`[Bb]ump ${token} from ${token} to ${token}(?: ${directory})?`;
+const bumpTo = String.raw`[Bb]ump ${token} to ${token}`;
+const joint = String.raw`[Bb]ump ${token}(?:, ${token})* and ${token}`;
+const byName = String.raw`[Bb]ump ${token}(?: ${directory}| across (?:[2-9]|[1-9]\d+) directories)`;
+const requirementVersion = String.raw`(?:[~^<>=!]+ )?${token}(?:, (?:[~^<>=!]+ )?${token})*`;
+const requirement = String.raw`[Uu]pdate ${token} requirement (?:from ${requirementVersion} )?to ${requirementVersion}`;
+const inGroup = String.raw`[Bb]ump ${token} from ${token} to ${token} in the ${group} group(?: across \d+ director(?:y|ies))?`;
+const groupWithUpdates = String.raw`[Bb]ump the ${group} group(?: ${directory}| across \d+ director(?:y|ies))? with \d+ updates?`;
+const dependabot = new RegExp(
+  String.raw`^build\(deps(?:-dev)?\): (?:${single}|${bumpTo}|${joint}|${byName}|${requirement}|${inGroup}|${groupWithUpdates})(?: \(#\d+\))?$`,
+);
+
 export default {
   extends: ["@commitlint/config-conventional"],
+  ignores: [(message: string) => dependabot.test(message)],
 };

package/docs/configs/commit-messages.md

@@ -11,6 +11,21 @@ The shared commitlint config holds each pull request title to the conventional c
 Commits follow `@commitlint/config-conventional`, shared from `node_modules/@avi2dg/checks/commitlint.config.ts`.
 It arrives with the kit, since `@commitlint/cli` and `@commitlint/config-conventional` are dependencies, not peers.
 
+A Dependabot title can capitalise `Bump` or `Update` after its prefix, which subject-case forbids.
+So the config skips every rule for a one-line title in one of the shapes Dependabot writes, whoever wrote it:
+
+- `build(deps)` or `build(deps-dev)`, then `Bump` or `bump`, then `X from A to B` with an optional `in /dir`, or `X and Y`, or `X, Y and Z`, or `X across N directories` with two or more, or `X in /dir`.
+- `build(deps)` or `build(deps-dev)`, then `Bump` or `bump`, then `the G group`, optionally `in /dir` or `across N directory or directories`, then `with N update` or `with N updates`.
+- `build(deps)` or `build(deps-dev)`, then `Bump` or `bump`, then `X from A to B in the G group`, optionally `across N directory or directories`.
+- `build(deps)` or `build(deps-dev)`, then `Bump` or `bump`, then `X to V`, when the previous version is unknown.
+- `build(deps)` or `build(deps-dev)`, then `Update` or `update`, then `X requirement`, then `from A` when the old requirement is known, then `to B`.
+  A requirement may carry an operator such as `~> 1.4.0`, and several may be listed with commas, such as `^0.20, ^0.21`.
+
+The title may end with the pull request number, such as ` (#123)`.
+A body keeps every rule.
+Every rule applies to any other title, including a hand-written title that uses a Dependabot prefix and verb but none of these shapes.
+`chore` is not in the list because no avi2d repository's Dependabot config writes it.
+
 ## Workflow
 
 The lint runs in CI on pull requests, because `jj` never fires a git hook.
@@ -25,7 +40,7 @@ The title lint runs before the docs-only filter, so a change to top-level Markdo
 It lints the pull request title, or the head subject when no open pull request heads the dispatched branch.
 The title is the enforced subject because a squash merge uses it as the main commit subject, and otherwise per-commit messages are not linted.
 GitHub appends the pull request number to the squashed subject, so the bin lints the title with ` (#0000)` attached.
-The header length limit applies to the landed subject, not the bare title.
+The header length limit applies to the landed subject, not the bare title, for any title the config does not skip.
 The bin moves the git comment character off `#`, so a title starting with `#` is linted like any other.
 The `ci` job also triggers on `workflow_dispatch`, as [checks-release-pr](../gates/checks-release-pr.md) and [checks-release-push](../gates/checks-release-push.md) say.
 GitHub holds the `pull_request` runs of a release pull request the workflow token opens until a maintainer approves them.

package/docs/design.md

@@ -190,7 +190,7 @@ Commits merged after the bump wait for the next release.
 Releases come from the version bumps across all of `HEAD`'s ancestry, not from tags.
 So a checkout without tags, a fork, and a branch that merged `main` in all write the same file when no release was reverted.
 A section keeps the date it was written, because the squash merge that lands the release commit may fall on another day.
-Entries come from commit subjects, which are the squash-merged pull request titles that commitlint holds to the conventional format.
+Entries come from commit subjects, the squash-merged pull request titles commitlint holds to the conventional format, except the Dependabot shapes [The commit message lint](configs/commit-messages.md) names.
 A commit body holds the branch's own messages, and nothing lints it, so no entry comes from a body.
 The changelog arrives in the release commit, and no workflow pushes to a branch a person works on.
 

package/docs/gates/checks-ci-wiring.md

@@ -69,7 +69,8 @@ A job on `push` or another trigger no fork reaches may still name self-hosted la
 In a private repository each mutation job carries exactly the labels the consumer declares in `package.json` under `checks.mutationRunner`.
 Every other job there carries exactly the hosted-default expression, or exactly one of the label sets the consumer declares under `checks.selfHostedRunners`.
 A job there also carries `runs-on: ${{ needs.<job>.outputs.runs-on }}` when the same workflow needs that job and that job calls the runner pick.
-The pick is the repository file `runner.yml` under `.github/workflows/` or `avi2d/workflows/.github/workflows/runner.yml` at a pinned full SHA.
+The pick is the repository file `runner.yml` under `.github/workflows/` or `avi2d/workflows/.github/workflows/runner.yml` at a full SHA or at a version tag, `v<major>` or `v<major>.<minor>.<patch>`.
+A branch name or a missing ref is not the pick.
 A public repository still refuses that expression on a job a fork can reach.
 The resolved label cannot be shown to be a hosted runner before the run.
 A repository without those declarations fails each job they would pin until it declares them.
@@ -94,7 +95,7 @@ The fleet version is the version the kit ships in its own `.bun-version`.
 The step fails the check when the version is missing or differs from the fleet bun version.
 A range fails because it differs from the fleet version.
 A version built from an expression fails because it cannot be shown equal before the run.
-A step that uses `avi2d/workflows/actions/setup` reads `.bun-version`.
+A step that uses `avi2d/workflows/setup` or `avi2d/workflows/actions/setup`, at any ref or none, reads `.bun-version`.
 The step fails the check when `.bun-version` is missing or differs from the fleet bun version.
 This rule skips a repository with no setup-bun step and no shared setup step.
 A kit release that moves the fleet version turns each consumer red until its pin follows.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.67.0",
+  "version": "0.68.1",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "author": {
     "name": "avi2d",

package/src/delivery/bun-pin.ts

@@ -17,7 +17,7 @@ export type BunPinFault = {
 
 const SETUP_BUN = /^oven-sh\/setup-bun(?:@(?<ref>.*))?$/i;
 const V2_REF = /^v2(?:\.\d+){0,2}$/;
-const SHARED_SETUP = /^avi2d\/workflows\/actions\/setup(?:@(?<ref>.*))?$/i;
+const SHARED_SETUP = /^avi2d\/workflows\/(?:actions\/)?setup(?:@.*)?$/i;
 const SETUP_VERSION_FILE = ".bun-version";
 
 function setupBunRef(uses: unknown): string | undefined {
@@ -25,9 +25,9 @@ function setupBunRef(uses: unknown): string | undefined {
   return match === null ? undefined : (match.groups?.["ref"] ?? "");
 }
 
-function sharedSetupRef(uses: unknown): string | undefined {
-  const match = typeof uses === "string" ? SHARED_SETUP.exec(uses.trim()) : null;
-  return match === null ? undefined : (match.groups?.["ref"] ?? "");
+function sharedSetupUses(uses: unknown): string | undefined {
+  const text = typeof uses === "string" ? uses.trim() : "";
+  return SHARED_SETUP.test(text) ? text : undefined;
 }
 
 function isExpression(value: string): boolean {
@@ -113,9 +113,8 @@ function unknownRefFault(ref: string): string {
   return `uses oven-sh/setup-bun at ${ref === "" ? "no ref" : ref}, but the check knows only setup-bun v2's version resolution, so the step must use oven-sh/setup-bun@v2`;
 }
 
-function sharedSetupFault(policy: BunPinPolicy, ref: string): string | undefined {
+function sharedSetupFault(policy: BunPinPolicy, uses: string): string | undefined {
   const version = nonEmpty(policy.files.get(SETUP_VERSION_FILE));
-  const uses = ref === "" ? "avi2d/workflows/actions/setup" : `avi2d/workflows/actions/setup@${ref}`;
   if (version === undefined) {
     return `uses ${uses}, which reads ${SETUP_VERSION_FILE}, but the repository holds no ${SETUP_VERSION_FILE} file, want ${policy.fleet}`;
   }
@@ -137,9 +136,9 @@ export function findBunPinFaults(policy: BunPinPolicy, workflows: readonly Workf
           const fault = V2_REF.test(ref) ? bunPinFault(policy, step) : unknownRefFault(ref);
           return fault === undefined ? [] : atStep(fault);
         }
-        const sharedRef = sharedSetupRef(step["uses"]);
-        if (sharedRef === undefined) return [];
-        const fault = sharedSetupFault(policy, sharedRef);
+        const sharedUses = sharedSetupUses(step["uses"]);
+        if (sharedUses === undefined) return [];
+        const fault = sharedSetupFault(policy, sharedUses);
         return fault === undefined ? [] : atStep(fault);
       });
     });
@@ -165,7 +164,7 @@ function versionFileKeys(job: Readonly<Record<string, unknown>>): readonly strin
 
 function usesSharedSetup(job: Readonly<Record<string, unknown>>): boolean {
   const steps = Array.isArray(job["steps"]) ? job["steps"] : [];
-  return steps.some((step) => isRecord(step) && sharedSetupRef(step["uses"]) !== undefined);
+  return steps.some((step) => isRecord(step) && sharedSetupUses(step["uses"]) !== undefined);
 }
 
 function wantedBunPinFiles(workflows: readonly Workflow[]): ReadonlySet<string> {

package/src/delivery/runner-pick.ts

@@ -1,7 +1,7 @@
 import { names, type Workflow } from "./workflow-references.ts";
 
 const NEEDS_RUNS_ON = /^\$\{\{\s*needs\.([\w-]+)\.outputs\.runs-on\s*\}\}$/i;
-const SHARED_RUNNER = /^avi2d\/workflows\/\.github\/workflows\/runner\.yml@[0-9a-f]{40}$/i;
+const SHARED_RUNNER = /^[Aa][Vv][Ii]2[Dd]\/[Ww][Oo][Rr][Kk][Ff][Ll][Oo][Ww][Ss]\/\.github\/workflows\/runner\.yml@(?:[0-9a-fA-F]{40}|v\d+(?:\.\d+\.\d+)?)$/;
 const LOCAL_RUNNER = ".github/workflows/runner.yml";
 
 function callsRunnerPick(uses: unknown, workflows: readonly Workflow[]): boolean {