[rgdevment]

Brings over what Tisty's main learnt since LinkUnbound last copied its pipelines (up to Tisty #548), without overwriting what LinkUnbound already does better: pre-push checking each pushed commit's tree, --landed over the whole push range, and news.sh reading the pushed news.json.

What changed

Hooks and scripts

• Branch names. scripts/commits.sh --branch checks that a branch is named kind/what, where the kind is a commit type, hotfix or release (for example feat/picker-tiles).
  • pre-commit runs it on the branch being committed on.
  • pre-push runs it on the name the branch takes on the remote.
  • Only main, a detached HEAD and GitHub's dependabot/* are exempt. Deleting a remote branch is still allowed.
• One-line commits. commit-msg refuses any line under the subject. It still folds a subject the editor wrapped into one line, and it lets Revert ", fixup!, squash!, amend! and merges through.
  • commits.sh checks the body of each commit on a branch, except Dependabot's.
  • It does not check bodies with --landed on main, because a squash carries the pull request's body.
• Subject length. A commit subject leaves room for the (#N) GitHub adds on squash: up to 112 characters. Titles are still checked at 120, number included.
• pre-push remote. It compares against the main of the remote being pushed to, not a fixed origin/main.
• Notices in pre-commit. When a lockfile is staged, pre-commit writes the third-party notices again, so a stale one is one git add away.
• rules.sh no longer walks .claude/ or vendor/ when it looks for Markdown.

CI

• ci.yml
  • A changes job decides whether the branch touched Rust. When it did not, test and both coverage jobs skip their Rust work. app/src/news.json counts as Rust, because the resident embeds it.
  • The new tests job reports for the test matrix. A matrix that is skipped never reports its names, so a required check on those names would wait forever.
  • On Windows the tests run on a trusted ReFS Dev Drive, with CARGO_PROFILE_DEV_DEBUG: line-tables-only. scripts/sidecar.sh now honours CARGO_TARGET_DIR for this.
  • coverage no longer runs on Dependabot pull requests. coverage-mac and sonar already skipped them.
  • sonar runs when coverage-mac was skipped, so Sonar still reads the picker.
  • cargo-deny is split in two. bans licenses sources blocks. advisories and both npm audit steps only warn on a pull request, and still fail on main.
• caches.yml. A new stop job cancels the runs still going for a closed pull request's last commit.
• rules.yml
  • zizmor runs --offline on pull requests. The online pass, which checks the pinned actions for known vulnerabilities, runs only on the schedule and on a manual run, with three tries.
  • A new advisories job runs every day. When something in the lock has an advisory or a yank, it moves only the crates named, regenerates the notices and pushes fix/advisories. The run ends red on purpose, so it reaches the inbox.

Why

• An advisory published one morning turned every unrelated pull request red, and chore(deps): patched rustls-webpki, clipboard-win, vite, markdown-it and test tooling clear every advisory check #72, fix(deps): pulldown-cmark 0.13.6 leaves the version RUSTSEC-2026-0414… #75 and fix(deps): tauri-plugin-updater 2.14.1 brings zip 9.1.3, closing the zip cloaking, symlink and AES HMAC advisories #76 were each a hand fix for exactly that.
• A pull request that only touches docs or the picker paid for the Windows and macOS suites and both coverage jobs.
• Branch names and commit bodies were not checked, even though both are public from the first push.

How it was checked

• commits.sh --branch passed feat/picker-tiles, fix/advisories, ci/tisty-pipelines, hotfix/a, release/2.9, dependabot/…, main and HEAD. It refused claude/…, rgdevment/feat-x, wip/algo, Feat/X and docs-languages.
• commit-msg passed a single line, a wrapped subject, a revert with its body and a fixup. It refused a subject with a body under it.
• pre-push was fed simulated push lines:
  • it passed feat/x, a deletion, and a push straight to a URL;
  • it refused wip/algo.
• Subject length: 113 characters is refused as a subject and passes as a title. In a range, 4945100 (a squash with a body) is refused, and passes with --landed.
• Static checks: every workflow and action parses with js-yaml. markdownlint finds nothing in CONTRIBUTING.md. bash -n passes on every hook and script, and scripts/rules.sh is green.
• Not run locally: actionlint and zizmor. The Rules job runs them on this pull request.

For the reviewer

• The required checks need to change once this pull request has reported tests. Replace test / windows-latest and test / macos-latest with tests in the Default ruleset. Until then, a pull request that does not touch Rust stays blocked on those two names.
• The Dev Drive moves the Windows target directory. The Windows cache misses once after this lands.
• rgdevment/... and claude/... branches no longer pass pre-commit or pre-push. Use kind/what instead.