The organization commit-lint suite (z-shell/.github/.github/workflows/commit-lint.yml) is callable, but this repository has no caller, so its rules are author-enforced only: the banned bot and AI-agent Co-authored-by trailer, Conventional Commit messages and PR titles (decisions/0003), the branch-name shape (decisions/0019), and issue traceability on the pull request (decisions/0022). z-shell/.github, z-shell/zi and z-shell/zsh-lint already run it.
Add the thin caller .github/workflows/commit-lint.yml used by z-shell/zsh-lint, pinned to the current main of z-shell/.github, with permissions: contents: read on the workflow and the job (a workflow-level permissions: {} capped the nested jobs and made every run a startup failure, z-shell/.github#575). The called workflow's default branch pattern accepts <type>-<id>[-slug] and <type>/<slug> over the Conventional Commit types plus feature, bug and hotfix; a repository whose own contract is narrower passes it through the branch-pattern input.
Once every maintained repository runs the caller, the private meta-workspace can stop composing a local commit-msg hook behind Trunk in each child, and the AGENTS.md sentence naming the enforcing repositories can be updated.
The organization commit-lint suite (
z-shell/.github/.github/workflows/commit-lint.yml) is callable, but this repository has no caller, so its rules are author-enforced only: the banned bot and AI-agentCo-authored-bytrailer, Conventional Commit messages and PR titles (decisions/0003), the branch-name shape (decisions/0019), and issue traceability on the pull request (decisions/0022).z-shell/.github,z-shell/ziandz-shell/zsh-lintalready run it.Add the thin caller
.github/workflows/commit-lint.ymlused byz-shell/zsh-lint, pinned to the currentmainofz-shell/.github, withpermissions: contents: readon the workflow and the job (a workflow-levelpermissions: {}capped the nested jobs and made every run a startup failure, z-shell/.github#575). The called workflow's default branch pattern accepts<type>-<id>[-slug]and<type>/<slug>over the Conventional Commit types plus feature, bug and hotfix; a repository whose own contract is narrower passes it through thebranch-patterninput.Once every maintained repository runs the caller, the private meta-workspace can stop composing a local commit-msg hook behind Trunk in each child, and the AGENTS.md sentence naming the enforcing repositories can be updated.