@avi2dg/checks 0.68.0 → 0.68.1

package/CHANGELOG.md

@@ -2,6 +2,14 @@
 
 Every release of `@avi2dg/checks`, newest first, written by the release from its conventional commits.
 
+## 0.68.1
+
+Released 2026-11-06.
+
+### Fixes
+
+- **commitlint:** accept Dependabot titles that open with Bump or Update [#50](https://github.com/avi2d/checks/pull/50)
+
 ## 0.68.0
 
 Released 2026-11-06.

package/commitlint.config.ts

@@ -1,3 +1,20 @@
+// subject-case cannot be relaxed for one author, so every rule skips the title shapes Dependabot writes.
+const token = String.raw`\S*[^\s.]`;
+const directory = String.raw`in \/\S*[^\s.]`;
+const group = String.raw`[\w.-]+`;
+const single = String.raw`[Bb]ump ${token} from ${token} to ${token}(?: ${directory})?`;
+const bumpTo = String.raw`[Bb]ump ${token} to ${token}`;
+const joint = String.raw`[Bb]ump ${token}(?:, ${token})* and ${token}`;
+const byName = String.raw`[Bb]ump ${token}(?: ${directory}| across (?:[2-9]|[1-9]\d+) directories)`;
+const requirementVersion = String.raw`(?:[~^<>=!]+ )?${token}(?:, (?:[~^<>=!]+ )?${token})*`;
+const requirement = String.raw`[Uu]pdate ${token} requirement (?:from ${requirementVersion} )?to ${requirementVersion}`;
+const inGroup = String.raw`[Bb]ump ${token} from ${token} to ${token} in the ${group} group(?: across \d+ director(?:y|ies))?`;
+const groupWithUpdates = String.raw`[Bb]ump the ${group} group(?: ${directory}| across \d+ director(?:y|ies))? with \d+ updates?`;
+const dependabot = new RegExp(
+  String.raw`^build\(deps(?:-dev)?\): (?:${single}|${bumpTo}|${joint}|${byName}|${requirement}|${inGroup}|${groupWithUpdates})(?: \(#\d+\))?$`,
+);
+
 export default {
   extends: ["@commitlint/config-conventional"],
+  ignores: [(message: string) => dependabot.test(message)],
 };

package/docs/configs/commit-messages.md

@@ -11,6 +11,21 @@ The shared commitlint config holds each pull request title to the conventional c
 Commits follow `@commitlint/config-conventional`, shared from `node_modules/@avi2dg/checks/commitlint.config.ts`.
 It arrives with the kit, since `@commitlint/cli` and `@commitlint/config-conventional` are dependencies, not peers.
 
+A Dependabot title can capitalise `Bump` or `Update` after its prefix, which subject-case forbids.
+So the config skips every rule for a one-line title in one of the shapes Dependabot writes, whoever wrote it:
+
+- `build(deps)` or `build(deps-dev)`, then `Bump` or `bump`, then `X from A to B` with an optional `in /dir`, or `X and Y`, or `X, Y and Z`, or `X across N directories` with two or more, or `X in /dir`.
+- `build(deps)` or `build(deps-dev)`, then `Bump` or `bump`, then `the G group`, optionally `in /dir` or `across N directory or directories`, then `with N update` or `with N updates`.
+- `build(deps)` or `build(deps-dev)`, then `Bump` or `bump`, then `X from A to B in the G group`, optionally `across N directory or directories`.
+- `build(deps)` or `build(deps-dev)`, then `Bump` or `bump`, then `X to V`, when the previous version is unknown.
+- `build(deps)` or `build(deps-dev)`, then `Update` or `update`, then `X requirement`, then `from A` when the old requirement is known, then `to B`.
+  A requirement may carry an operator such as `~> 1.4.0`, and several may be listed with commas, such as `^0.20, ^0.21`.
+
+The title may end with the pull request number, such as ` (#123)`.
+A body keeps every rule.
+Every rule applies to any other title, including a hand-written title that uses a Dependabot prefix and verb but none of these shapes.
+`chore` is not in the list because no avi2d repository's Dependabot config writes it.
+
 ## Workflow
 
 The lint runs in CI on pull requests, because `jj` never fires a git hook.
@@ -25,7 +40,7 @@ The title lint runs before the docs-only filter, so a change to top-level Markdo
 It lints the pull request title, or the head subject when no open pull request heads the dispatched branch.
 The title is the enforced subject because a squash merge uses it as the main commit subject, and otherwise per-commit messages are not linted.
 GitHub appends the pull request number to the squashed subject, so the bin lints the title with ` (#0000)` attached.
-The header length limit applies to the landed subject, not the bare title.
+The header length limit applies to the landed subject, not the bare title, for any title the config does not skip.
 The bin moves the git comment character off `#`, so a title starting with `#` is linted like any other.
 The `ci` job also triggers on `workflow_dispatch`, as [checks-release-pr](../gates/checks-release-pr.md) and [checks-release-push](../gates/checks-release-push.md) say.
 GitHub holds the `pull_request` runs of a release pull request the workflow token opens until a maintainer approves them.

package/docs/design.md

@@ -190,7 +190,7 @@ Commits merged after the bump wait for the next release.
 Releases come from the version bumps across all of `HEAD`'s ancestry, not from tags.
 So a checkout without tags, a fork, and a branch that merged `main` in all write the same file when no release was reverted.
 A section keeps the date it was written, because the squash merge that lands the release commit may fall on another day.
-Entries come from commit subjects, which are the squash-merged pull request titles that commitlint holds to the conventional format.
+Entries come from commit subjects, the squash-merged pull request titles commitlint holds to the conventional format, except the Dependabot shapes [The commit message lint](configs/commit-messages.md) names.
 A commit body holds the branch's own messages, and nothing lints it, so no entry comes from a body.
 The changelog arrives in the release commit, and no workflow pushes to a branch a person works on.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@avi2dg/checks",
-  "version": "0.68.0",
+  "version": "0.68.1",
   "description": "Deterministic checks shared across a set of TypeScript repositories",
   "author": {
     "name": "avi2d",