ci: use a maintained commitlint action fork

[robinbowes]

What

Points the commitlint job at yo61/commitlint-github-action — a maintained fork running commitlint v21 on Node 24.

Why

Dependabot PRs fail the commitlint job on body-max-line-length, while the pre-commit lint job passes the same commit. Same commit, same commitlint.config.mjs, different verdict.

@commitlint/ensure v20 added an exemption for long lines containing a URL:

const URL_REGEX = /\bhttps?:\/\/\S+/;
value.split(/\r?\n/).every((line) => URL_REGEX.test(line) || ensure(line, max));

wagoid/commitlint-github-action@v6.2.1 is the latest release and pins @commitlint/ensure: ^19.0.3, so CI enforced a stricter rule than the config intends. Dependabot bodies are markdown link lists — one real example is 314 characters on a single line.

Upstream is unmaintained: no commit to master since 2025-01-14, and the v20 bump (PR #837) has been open and mergeable since July with no response.

The fork

yo61/commitlint-github-action@v6.3.0 — all @commitlint/* at ^21, Node 24.19.0 LTS (v21 needs node >= 22.12), commitlint-plugin-function-rules at ^5 (v4's peer range caps at <20 and breaks npm ci), published to ghcr.io from a pushed tag. Actions SHA-pinned, least-privilege permissions, actionlint and zizmor clean.

Verified against the action's own load+lint path with a real commitlint.config.mjs:

Case	Result
Dependabot commit, 314-char body line	valid
Sentence-case subject with subject-case: [0]	valid — the .mjs override is honored
Malformed commit	rejected

Commit subjects stay validated for Dependabot as well as humans, rather than exempting bot commits.

[yo61-lastlight]

pr-review is waiting for cluster capacity — it'll start automatically when a slot frees.

[yo61-lastlight]

Replaces the stale wagoid/commitlint-github-action (pinned to @commitlint/ensure ^19) with a direct npx invocation pinned to @commitlint/cli@21.2.1 / @commitlint/config-conventional@21.2.0, matching the pre-commit hook's ^21 range, and narrows the job's permissions from pull-requests:read to contents:read now that the commit range comes from local git instead of the GitHub API. Verified independently: both actions/checkout@de0fac2 (v6.0.2) and actions/setup-node@8207627 (v7.0.0) SHAs resolve to the tags they claim; the exact npm versions (21.2.1/21.2.0) exist and the npx --package invocation resolves commitlint.config.mjs's extends: ['@commitlint/config-conventional'] correctly (tested locally). Shell injection is avoided by passing the SHAs through env vars rather than interpolating them into the run script. One thing worth noting for context, not a defect in this diff: commitlint.config.mjs already has an ignores rule that fully exempts any commit containing 'Signed-off-by: dependabot[bot]' (added in #136), and every real Dependabot commit in this repo's history carries that trailer — I reproduced this repo's actual long-line Dependabot commit bodies against both @commitlint/cli 19.8.1 and 21.2.1 and both pass, because ignores short-circuits the whole message before any rule (including body-max-line-length) runs, regardless of @commitlint/ensure version. So the specific failure mode described in the issue may not currently reproduce in jobhound itself (it likely does in one of the other 8 repos this fix is templated across); this PR is still a net improvement here — deterministic version pins matching the local hook, a stale/less-maintained action dropped, and permissions tightened — so I have no blocking objection.

[yo61-lastlight]

Prior bot review (at 1d7b56a, DISMISSED) had no blocking findings and only a non-blocking informational note that the described failure mode may not currently reproduce in this repo because commitlint.config.mjs already exempts Dependabot's Signed-off-by trailer — that observation still stands and isn't affected by this commit. The new commit (c2d7165) addresses the one real gap left after that review: the previous fix pinned commitlint versions via npx --package flags in the workflow's run: block, which Dependabot cannot see or update. This change moves the pins into a tracked .github/commitlint/package.json + package-lock.json, installs with npm ci, and registers the directory with Dependabot's npm ecosystem, consistent with the other entries in dependabot.yml. The workflow correctly points cache-dependency-path and the commitlint binary invocation at the new nested install, and node_modules/ is gitignored. No correctness, security, or contract issues found in this diff.

[yo61-lastlight]

pr-review is waiting for cluster capacity — it'll start automatically when a slot frees.

[yo61-lastlight]

Two prior bot reviews on this PR (at earlier SHAs) were dismissed by superseding pushes and had no blocking findings; the diff has since changed entirely (from an npx-based commitlint invocation to the current one-line action swap), so neither carries forward. Reviewing the current diff fresh: it swaps the stale, SHA-pinned wagoid/commitlint-github-action@v6.2.1 for a SHA-pinned yo61/commitlint-github-action@v6.3.0, with a comment explaining the @commitlint/ensure v19→v21 URL-exemption gap. I verified the pinned SHA (31e5e045...) is the actual commit tagged v6.3.0 in yo61/commitlint-github-action, that the fork's action.yml still resolves configFile/permissions the same way as upstream (so the existing pull-requests:read grant and fetch-depth:0 in this job stay correct), and that CI on this exact head SHA (run 31497347112) passed. No correctness or security issues in this one-line change.