fix(ci): configure commitlint to accept workspace-scoped Dependabot commit format

[jeremyjs]

Problem

Dependabot generates commit messages with compound scopes for workspace-scoped bumps:

chore(deps,cli)(deps-dev): bump @types/node from 22.19.19 to 22.19.20 in /packages/cli

The current commitlint.config.cjs does not allow comma-separated scopes, so Commitlint fails on every workspace-level dep bump PR. PRs #82 and #83 demonstrate this failure. It will recur on every future workspace dep upgrade.

Scope

Update commitlint.config.cjs only. Allow comma-separated scopes (e.g. scope-enum or scope-case rules to be made permissive for the Dependabot pattern). No changes to scanner logic, CLI flags, or action.yml.

Acceptance Criteria

• A commit with message chore(deps,cli)(deps-dev): bump @types/node from X to Y passes commitlint
• A standard feat(foo): something still passes
• A malformed commit like badformat: oops still fails
• CI is green on a test PR that replicates the Dependabot message format

Non-goals

• Changing Dependabot configuration
• Changing any scanner behavior or output

QA Checklist

• echo "chore(deps,cli)(deps-dev): bump foo 1→2" | npx commitlint exits 0
• echo "feat: valid" | npx commitlint exits 0
• echo "badformat: oops" | npx commitlint exits non-zero
• CI green on a PR with workspace-scoped Dependabot-style commit

Risk

Low — commitlint config only, no user-visible output changes.

Dependencies

None. Fixes the recurring Dependabot PR CI failure pattern (current instances: #82, #83).

[jeremyjs]

PM Azimuth — 2026-06-14 — Kickoff

Reliability journey step: CI Ergonomics (structural fix)

Why this is priority 0: PRs #82 and #83 are blocked by this exact issue. Without this fix, every future workspace-level Dependabot bump will fail CI with the same pattern. It must land before or immediately after the current cycle clears.

What to change: commitlint.config.cjs — configure the scope rules to allow comma-separated workspace scopes generated by Dependabot. The pattern to support: chore(deps,<workspace>)(deps-dev): ...

Required test coverage:

• Test that chore(deps,cli)(deps-dev): bump foo 1→2 passes commitlint
• Test that a standard conventional commit still passes
• Test that a malformed commit still fails

Dependencies: None.
Risk: Low — commitlint config change only, no scanner or output changes.
Do not: Change any existing scanner rules, CLI flags, action.yml inputs, or severity thresholds.

[jeremyjs]

PM Azimuth — 2026-06-18 — Cycle Launch

UNBLOCKED. Proceed immediately.

The previous cycle was blocked due to ≥3 open PRs. Today's housekeeping merged PRs #89, #91, #94, and #96 (all CI-passing Dependabot bumps), reducing the open PR count to 5. Issue #85 is launched as a structural CI prerequisite exempt from the queue rule — it directly reduces the remaining blocked queue, not adds to it.

---

Reliability journey step: CI Ergonomics — prerequisite for all workspace-scoped Dependabot automation

Why this must land today:

• 4 of the 5 remaining open PRs (chore(deps,web)(deps): bump next from 16.2.7 to 16.2.9 in /apps/web in the next-stack group #90, chore(deps,web)(deps-dev): bump the tailwind-stack group in /apps/web with 2 updates #92, chore(deps,web)(deps-dev): bump @types/node from 22.19.19 to 22.19.21 in /apps/web #93, chore(deps,cli)(deps-dev): bump @types/node from 22.19.19 to 22.19.21 in /packages/cli #95) fail Commitlint because they use Dependabot's compound scope format: chore(deps,cli)(deps-dev): bump X
• The current commitlint.config.cjs does not allow comma-separated scopes
• This will recur on every future workspace-level dep bump until fixed
• No other cycle work can clear the queue until this lands

What to change — scope is narrow:
File: commitlint.config.cjs only.

Allow Dependabot's compound scope format. Two valid approaches:

1. Add 'scope-case': [0] to disable scope case enforcement (already done for subject-case), and relax scope-enum to allow any scope — OR —
2. Keep scope-enum validation but extend it to allow comma-separated token lists, e.g. using a custom plugin or pattern rule

Recommended approach: Set 'scope-enum': [0] (disabled) to allow any scope including compound ones. The type-enum enforcement (already in place) provides the meaningful gate. Scope-enum adds little safety and creates maintenance burden when Dependabot scope names change.

Acceptance criteria:

• chore(deps,cli)(deps-dev): bump @types/node from X to Y passes commitlint ✅
• chore(deps,web)(deps-dev): bump tailwindcss from X to Y passes commitlint ✅
• feat: add new feature still passes ✅
• invalid-type: something still fails ✅
• commitlint.config.cjs is the only changed file
• All existing tests pass (pnpm test)
• CI runs green on the PR

Required test/fixture coverage:
Add a unit test or inline comment in commitlint.config.cjs citing the Dependabot compound scope pattern. Ideally add a commitlint.test.mjs (or equivalent) that exercises both the pass and fail cases using the @commitlint/lint programmatic API.

Non-goals:

• Do not change type-enum, subject-case, body, or footer rules
• Do not touch scanner logic, CLI flags, action.yml, or any other file

Risk: Low — dev tooling only; no impact on published CLI or Action contract

Sequencing: After this PR merges, PRs #90, #92, #93, #95 should re-run CI and pass Commitlint. They can then be merged (pending self-scan results).

Next in queue (held until this merges): Issues #78, #79, #80 (FP reduction trilogy) — currently cycle:current, agent:ready.

[jeremyjs]

Cycle Launch Summary — 2026-06-18

Completed (housekeeping)

PR	Title	Result
#89	chore: turbo bump (root)	✅ Merged
#91	chore: tailwind bump (root)	✅ Merged
#94	chore: next bump (root)	✅ Merged
#96	chore: @types/node bump (root)	✅ Merged

Open PR count: 9 → 5

Active this cycle

Issue	Title	Status
#85	fix(ci): commitlint compound-scope support	🚀 LAUNCHED — agent should implement now
#97	investigate(ci): non-deterministic self-scan	📋 CREATED — investigation queued

Queued (next, after #85 merges and PR count drops)

Issue	Title	Why held
#78	fix(rules): SQL tagged-template FP	PR count still > 3 after launch
#79	fix(rules): type-def secret FP	PR count still > 3 after launch
#80	fix(rules): config-log A09 FP	PR count still > 3 after launch

Explicitly out of scope today

• Issue feat(config): project-level .owasp-wtf.yml config file with CLI flag precedence #86 (project config file) — risk:medium; hold until FP work lands
• Issue feat(output): report suppressed finding count in terminal, JSON, and SARIF metadata #87 (suppressed finding count) — hold until feat(config): project-level .owasp-wtf.yml config file with CLI flag precedence #86 shape is clear
• Issue feat(config): framework-aware safe-pattern allowlist for native rules #81 (framework allowlist) — depends on feat(config): project-level .owasp-wtf.yml config file with CLI flag precedence #86 config shape
• A04/A08 native rules — not scoped yet; need human input on patterns
• Any change to action.yml, severity thresholds, OWASP mappings, or CLI public surface

Unblocking sequence after #85

1. fix(ci): configure commitlint to accept workspace-scoped Dependabot commit format #85 PR merges → Dependabot PRs chore(deps,web)(deps): bump next from 16.2.7 to 16.2.9 in /apps/web in the next-stack group #90/chore(deps,web)(deps-dev): bump the tailwind-stack group in /apps/web with 2 updates #92/chore(deps,web)(deps-dev): bump @types/node from 22.19.19 to 22.19.21 in /apps/web #93/chore(deps,cli)(deps-dev): bump @types/node from 22.19.19 to 22.19.21 in /packages/cli #95 re-run CI → Commitlint passes → merge → PR count → ~1
2. Issues feat(rules): avoid SQL injection false positives on parameterized tagged template literals #78/feat(rules): reduce A02-HARDCODED-SECRET false positives on type definitions and UI strings #79/feat(rules): reduce A09-SENSITIVE-LOG false positives on configuration/status messages #80 launch in parallel (3 independent PRs)
3. After those merge → self-scan should go green → Issue investigate(ci): diagnose non-deterministic self-scan results across Dependabot root bumps #97 investigation can confirm root cause
4. Issue feat(output): report suppressed finding count in terminal, JSON, and SARIF metadata #87 (suppressed count) → promote to cycle:current