chore: validate Dependabot commits instead of skipping them

.github/dependabot.yml

@@ -6,6 +6,11 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 7
+    # Pin the prefix rather than relying on Dependabot's auto-detection, so
+    # its commits satisfy commitlint now that they are no longer ignored.
+    commit-message:
+      prefix: "chore"
+      include: "scope"
     groups:
       hooks:
         patterns: ["*"]
@@ -18,6 +23,11 @@ updates:
       interval: "weekly"
     cooldown:
       default-days: 7
+    # Pin the prefix rather than relying on Dependabot's auto-detection, so
+    # its commits satisfy commitlint now that they are no longer ignored.
+    commit-message:
+      prefix: "chore"
+      include: "scope"
     groups:
       actions-minor-patch:
         update-types: ["minor", "patch"]

.github/workflows/ci.yml

@@ -19,12 +19,11 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
-      # Fork of wagoid/commitlint-github-action: upstream is unmaintained and pins
-      # @commitlint/ensure ^19, which predates the exemption for long lines
-      # containing a URL added in v20. Dependabot bodies are markdown link lists
-      # well over 100 chars, so ^19 fails them on body-max-line-length while the
-      # pre-commit hook (v21) passes them.
-      - uses: yo61/commitlint-github-action@31e5e0454fc0709625e6dcfb502ea18978f45f15  # v6.3.0
+      # Fork of wagoid/commitlint-github-action. Upstream is unmaintained: no
+      # commit to master since 2025-01-14, and it pins @commitlint/ensure ^19,
+      # two majors behind. This fork runs commitlint v21 on node 24, and pins its
+      # runtime image by digest so the SHA pin here cannot be worked around.
+      - uses: yo61/commitlint-github-action@501ff7bb31eb7133c871318c877d0e43cd1ff500  # v6.3.0 (digest-pinned)
         with:
           configFile: commitlint.config.mjs
 

commitlint.config.mjs

@@ -1,9 +1,5 @@
 export default {
   extends: ['@commitlint/config-conventional'],
-  // Dependabot auto-generates commit bodies with long markdown URLs that exceed
-  // body-max-line-length. It won't wrap them, so skip linting its commits while
-  // keeping the full ruleset enforced for human authors.
-  ignores: [(message) => message.includes('Signed-off-by: dependabot[bot]')],
   rules: {
     // No scope-enum: this repo is a single package (the marketplace), so scope is decorative.
     'subject-case': [0],