ci(release): reject unconfigured commit types and require ports to name upstream

[IgorShevchik]

Linked issue

Resolves #437

Follow-up filed: #472 (the install cost of the title job).

Type of change

• Documentation (updates to the documentation or readme)
• Bug fix (a non-breaking change that fixes an issue)
• Enhancement (improving an existing functionality)
• New feature (a non-breaking change that adds functionality)
• Chore (updates to the build process or auxiliary tools and libraries)
• Revert (undoing a merged change — retitle this PR revert(Scope): ...)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

Two ways a commit reaches the changelog wrong, both silent, and one convention that makes ported work traceable once it gets there. assert-commit-parses.mjs already caught a third — a message the parser throws on — and this extends it rather than adding scripts beside it: the family is "this commit will not appear correctly", and it should have one place and one error voice.

1. A type with no section (#437)

changelog-sections replaces the preset's type list wholesale, so a type absent from ours has no entry. An ordinary commit of that type is dropped. A breaking one is worse — the note keeps it alive, but the section rewrite in conventional-changelog-conventionalcommits is guarded by if (entry), so commit.type stays the raw string and becomes the group title, and commitGroupOrder.indexOf(title) returns -1, which sorts it above index 0.

Reproduced before writing anything, by running the real writer at the version release-please uses, over this repository's actual config:

### ⚠ BREAKING CHANGES
* **Theme:** the legacy palette is gone.

### style                              ← raw lowercase type, above everything
* **Theme:** drop the legacy palette

### Features
...

Option 2 from the issue, taken over hidden entries per type: twelve types appear in this history with no entry — playground 31 times, doc 23, style 22 — and the list would never be finished, because it cannot cover feal(init), ix or hore.

The type comes from the AST the parse already produced, not from a second regex — see the review notes; that distinction turned out to be the difference between a working check and a decorative one. The type list is read from release-please-config.json, not restated.

Swept over every commit reachable on main: one rejection, dcb3bacf, the commit this guard was originally written about (#436).

2. The check moves earlier, without pretending to be the guarantee

pr-title.yml runs the parse and type checks on the PR title, with edited in the trigger list so a corrected title turns green without an empty push. Its header says what it is not: the squash subject can be rewritten in the merge dialog — #440 was — and the upstream-reference check cannot run from a title at all, so green there does not mean every rule is satisfied.

The title reaches the script through the environment, not the command line, since it is arbitrary text from whoever opened the PR.

3. Ports name the upstream commit

Requested by the maintainer, delivered as a reference rather than upstream's own first line — a departure agreed before implementing.

fix(Range): forward aria attributes to the thumb (nuxt/ui@d6c3802)

Only the subject reaches CHANGELOG.md, so it is the one place a reader can be handed a way back. Upstream's wording would not survive the trip: their Slider is this fork's Range, and PORTING.md §1 makes that rename mandatory, so their first line would name a component this library does not ship.

The trigger is a new entry whose decision is port. Narrower than it looks, and it has to be — 70 of the ledger's entries are no-op, noop, skip or n/a:

commit	what it is	result
#467	reconciles existing entries	passes
#442, #439, #361	record a no-op or a skip	passes
#470	ordinary local work	passes
#466, #464	real ports	flagged

A batch (§6 4b) names any one of the SHAs it added. PORTING.md §6 carries the rule; §7 puts both halves on the reviewer, because CI only sees the reference after the squash.

Review notes

Six defects, three of them undermining the point of the branch. All confirmed by running.

#	Finding	Resolution
1	The type check could be walked past. /^([a-z]+)/i reads a letters-only prefix; the parser's token runs to the first (, !, : or space. fix2(x): read as fix and was accepted; 2fix(x): captured nothing, skipped the check and printed "type undefined has a section" — next to my own comment calling that impossible	Type taken from the AST. Mutation then showed the fix had no test behind it: the original regex still passed all 75 cases, because every unconfigured type in the spec was letters. Four cases added
2	The port check flagged commits that port nothing. Keyed on any new ledger entry; #442, #439 and #361 were flagged — correct messages, on main, unfixable	Trigger is decision === 'port'
3	The new tests would have failed every CI run. They worktree'd onto real SHAs while this branch sets fetch-depth: 2, so the objects are absent on CI	Rewritten against a synthetic two-commit repository — which also removes a race that bit this branch for real: a concurrent process restoring the same file twice discarded edits mid-review
4	A batch port was required to name every SHA, while §6 4b and the docstring say one is enough	Any one
5	The ledger key was interpolated into new RegExp — an entry keyed (a+)+$ hangs the check	Substring test against a key checked to be a SHA
6	An unreadable ledger warned at HEAD^ and was silent at HEAD	Both warn

Two coverage holes closed on review's evidence: disabling isMergeCommit() killed no test, and "reads the type list from the config" was a string-containment check that a hardcoded copy passes with the comment intact — it now stands the script beside a config naming a type this repository does not configure and requires it to be accepted.

Docs corrected where they promised more than the code does: §7 said CI checks the reference (it does, but only post-squash), pr-title.yml now states its own limits, and AGENTS.md states both requirements, which until now were discoverable only by reddening CI.

Nine mutations that previously killed nothing now each kill at least one case.

Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.

Gate run locally with CI=true: lint · typecheck · test (310 files, 7128 passed, 6 skipped).