chore: validate Dependabot commits instead of skipping them

[robinbowes]

What

Stops exempting Dependabot from commitlint, and pins Dependabot's commit prefix so its subjects are conventional by construction.

Why

commitlint.config.mjs ignored any commit containing Signed-off-by: dependabot[bot], which every Dependabot commit carries. Its subjects were therefore never validated — including the chore(deps): … prefix that release tooling reads.

The exemption was there for a real reason: Dependabot writes long unwrapped markdown URLs in commit bodies, which tripped body-max-line-length. That reason no longer holds. @commitlint/ensure v20 added an exemption for lines containing a URL:

const URL_REGEX = /\bhttps?:\/\/\S+/;
value.split(/\r?\n/).every((line) => URL_REGEX.test(line) || ensure(line, max));

CI now runs commitlint v21 via yo61/commitlint-github-action, so those bodies pass on their own merits.

Order of operations

The prefix is pinned in the same commit that removes the exemption, so there is no window where Dependabot commits are validated while their subject format still depends on auto-detection.

Verification

Replayed the action's own load+lint path against this repo's commitlint.config.mjs with the exemption removed, using a real Dependabot commit whose body has a 314-character line:

Case	Result
Dependabot commit, 314-char body line	valid
Malformed commit	rejected

Live proof: yo61/agent-team-topologies has never had this exemption, and its Dependabot PR #7 is green under the same action.

[yo61-lastlight]

Removes the commitlint exemption for Dependabot commits and pins Dependabot's commit-message prefix/scope in the same change, so Dependabot subjects are validated instead of skipped. The stated rationale (commitlint v21's URL-line exemption in body-max-line-length, already in CI via the fork from PR #36) checks out against the config, and the new prefix/scope matches the format Dependabot's auto-detection already produced historically (chore(deps): ...), so this is low-risk. No functional or contract issues found.

[yo61-lastlight]

Re-review after a prior clean APPROVE (at eb6da03) with no findings raised then — that verdict still stands for the two files it covered (commitlint.config.mjs, and the un-pinned action.yml reference it saw). The one new commit since then (e0b3e2a) re-pins the commitlint action to a digest rather than a mutable tag, which I've verified against the fork's action.yml at that exact SHA and is correct. However, the PR's core safety claim — that the prefix pin and the exemption removal land in the same commit so there is no window of unvalidated auto-detected subjects — is only true for the pre-commit ecosystem. The github-actions ecosystem entry added in #37 has no commit-message override, so its Dependabot commits still depend on auto-detection while the exemption that used to protect them is gone.

Additional findings

• [Important] github-actions ecosystem still relies on auto-detected prefix, contradicting the PR's stated guarantee (.github/dependabot.yml:25) — Only the pre-commit block gets a pinned commit-message.prefix. The github-actions block (added in #37) has none, so its Dependabot commits still depend on Dependabot's auto-detection of a conventional prefix from commit history — exactly the situation the PR's "Order of operations" section says is eliminated ("there is no window where Dependabot commits are validated while their subject format still depends on auto-detection"). This ecosystem has produced zero Dependabot commits so far, so there's no historical precedent to auto-detect from; if the next github-actions bump doesn't happen to produce a @commitlint/config-conventional-compliant subject, it fails CI now that the blanket exemption is removed.

[yo61-lastlight]

Re-review at 8caeb1a. Prior-findings ledger: (1) clean APPROVE at eb6da03 for commitlint.config.mjs and the action.yml reference it saw — still stands, untouched since. (2) digest-pin of the commitlint action fork, verified at e0b3e2a — still correct, unchanged (8caeb1a is an identical re-push of e0b3e2a, same tree). (3) [Important] github-actions ecosystem still relies on Dependabot's auto-detected prefix, contradicting the PR's 'no window of unvalidated auto-detection' guarantee — still open; .github/dependabot.yml's github-actions block (added in #37) has no commit-message.prefix override, and nothing in this PR's commits touches it. This PR removes the blanket commitlint exemption for all Dependabot commits, but only pins the prefix for the pre-commit ecosystem, leaving github-actions bumps exposed to the same auto-detection risk the PR claims to have eliminated.

Additional findings

• [Important] github-actions ecosystem still depends on auto-detected commit prefix (.github/dependabot.yml:20) — Only the pre-commit block (lines 9-13) gets a pinned commit-message.prefix. The github-actions block below has none, so its Dependabot commits still rely on auto-detection of a conventional subject — exactly the gap the PR's 'Order of operations' section says is closed ('there is no window where Dependabot commits are validated while their subject format still depends on auto-detection'). This ecosystem has produced zero commits so far, so there's no history to auto-detect from; the first github-actions bump that doesn't happen to match @commitlint/config-conventional now fails CI with the blanket exemption removed.

[yo61-lastlight]

Re-review at 43ce17b. Prior-findings ledger: (1) clean APPROVE at eb6da03 for commitlint.config.mjs's exemption removal — still stands, untouched. (2) digest-pin of the commitlint action fork, verified at e0b3e2a/8caeb1a — still correct, unchanged. (3) [Important] github-actions ecosystem lacked a pinned commit-message prefix, contradicting the PR's 'no window of unvalidated auto-detection' guarantee — fixed: the one new commit since the last review adds the identical commit-message.prefix/include block to the github-actions entry in .github/dependabot.yml, closing the gap for both ecosystems. Both Dependabot blocks now pin the prefix in the same change that removed the blanket commitlint exemption, matching the PR's stated order-of-operations guarantee. No new issues found.