[uniqueg]

Summary

Last of the stacked pull requests for #464. Stacked on #473 (on #470): merge those first; until then this diff also shows their commits.

• ci.yml / CI (renamed from pr_evaluation.yml / PR Evaluation), with the organization's job names: Conflict markers, Lint, Test (Node 22), Test (Node 24) and the gate CI passed, which fails unless all other jobs passed. Runs on pull requests and on pushes to dev, the default branch. Read-only token, no persisted credentials, timeouts, superseded PR runs cancelled, fail-fast: false for the test matrix. Lint also runs the tests of scripts/release.js (ci: npm trusted publishing and GitHub releases #473).

• pr-title.yml / PR title: the Conventional Commit title check (same rules), in its own workflow, so that editing a title or description reruns only this check. Runs on pull requests to dev.

• Changesets removed (.changeset/, @changesets/cli): its config still named main and an outdated package list; releases set versions in a version bump pull request now.

• CONTRIBUTING.md: what's specific to this repository (PR flow against dev, main = latest release, title rules, checks, reviews, AI-assisted PRs) and the release steps in order:

  1. version bump pull request to dev (node scripts/release.js set <version>);
  2. signed tag v<version> on dev;
  3. approve the npm environment of the Release run;
  4. approve the staged versions on npmjs.com (2FA); dist-tag latest for releases and for the 2.0.0 alphas (prereleases of a major without a release yet), the prerelease identifier after that;
  5. fast-forward main to the tag.

  Plus what to do when a release fails (no re-tagging; re-run after partial staging; reject staged versions). General rules link to the org guide. The PR template's link now resolves; the README's contributing link (old org guide URL, 404) points to it.

• .github/CODEOWNERS: * @anuragxxd.

Closes #468

Verification

• actionlint 1.7.12 and zizmor 1.31.1 (offline): no findings for all workflows.
• node --test scripts/release.test.js: 8 tests pass. npm run lint passes locally (on ci: npm trusted publishing and GitHub releases #473's tree).
• CI on this PR (after merging ci: npm trusted publishing and GitHub releases #473 with dev, which now has build: move CI and Docker to Node.js 22 and 24 #470 and test: drop test scripts of packages without tests #478; head 92cd777): Conflict markers, Lint (with the release script tests), Test (Node 22), Test (Node 24), CI passed and PR title pass. The RTD check fails here because .readthedocs.yaml comes with docs: host the docs on Read the Docs #476.
• Reviewed by the adversarial and quality reviewer subagents (2 rounds, before the branch switch). The changes since (trigger switch to dev, changesets removal, CI test step, release docs) are CI, dependency removal and docs: light lane, reviewed by hand; the release workflow they document was fully reviewed in ci: npm trusted publishing and GitHub releases #473.

Declined review findings

• CI doesn't run when a stacked PR is retargeted (only an edited event): otherwise a push or close/reopen triggers CI. Listening to edited would rerun CI on every description edit, which this PR removes.
• The AI-assisted PR paragraph in CONTRIBUTING.md was questioned as a new policy: it is part of the agreed contribution flow.

Maintainer steps (after merge)

• Add CI passed and PR title (source: GitHub Actions) as required status checks to the dev ruleset, once both have reported on a PR.
• No bypass for deploy keys is needed any more: releases push nothing.

🤖 Generated with Claude Code

Summary by Sourcery

Streamline contribution and release management around a unified CI gate, dedicated title validation, and documented repository workflows.

New Features:

• Add a unified CI workflow with conflict detection, linting, release-script tests, supported Node.js test coverage, and a single required status gate.
• Add a dedicated pull request title workflow enforcing the repository’s Conventional Commit title rules.
• Add repository contribution and release guidance, including version bump, tagging, npm publishing, and recovery procedures.

Bug Fixes:

• Correct the README contributing link to point to the repository’s contribution guide.

Enhancements:

• Remove Changesets and its configuration and dependency in favor of versioning through release pull requests.
• Add CODEOWNERS coverage for the repository.

CI:

• Replace the previous pull request evaluation workflow with separate CI and pull request title workflows targeting the dev branch and its pushes.

Documentation:

• Document repository-specific pull request practices, reviews, AI-assisted contributions, and the release process.

[changeset-bot]

⚠️ No Changeset found

Latest commit: 1279b73

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
elixir-cloud-components	Error		Oct 26, 2026 7:21pm UTC

[sourcery-ai]

Reviewer's Guide

This PR replaces the prior PR-evaluation setup with a single, security-conscious CI workflow and explicit CI passed gate, isolates title validation into its own check, modernizes the tag-driven release pipeline for Node 24 and npm trusted publishing, and adds repository-specific contribution, ownership, dependency-update, and runtime documentation.

Sequence diagram for pull request validation

sequenceDiagram
    actor Contributor
    participant GitHub
    participant CI
    participant PRTitle as PR title
    participant Gate as CI passed

    Contributor->>GitHub: Open or update pull request
    GitHub->>PRTitle: Run title check
    PRTitle-->>GitHub: Report PR title result
    GitHub->>CI: Run CI workflow
    CI->>CI: Run Conflict markers
    CI->>CI: Run Lint
    CI->>CI: Run Test Node 22 and 24
    CI->>Gate: Check all job results
    Gate-->>GitHub: Report CI passed result

Loading

Sequence diagram for tag-driven release

sequenceDiagram
    actor Maintainer
    participant GitHub
    participant Release
    participant Main
    participant NPM

    Maintainer->>GitHub: Push version tag on main
    GitHub->>Release: Start Release workflow
    Release->>Release: Run lint
    Release->>Main: Commit and push version bump
    Release->>NPM: Publish packages with OIDC trusted publishing
    NPM-->>Release: Return publication and provenance status
    Release->>GitHub: Create GitHub release

Loading

File-Level Changes

Change	Details	Files
Consolidates pull-request and main-branch validation into a single CI workflow with an explicit aggregate gate.	Renames and restructures the existing evaluation workflow around conflict detection, linting, Node 22/24 test matrix jobs, and the required CI passed result. Adds least-privilege permissions, pinned actions, credential-free checkouts, timeouts, concurrency cancellation, dependency/browser caching, and non-fast-failing matrix execution. Ensures the aggregate gate fails for any failed, cancelled, or skipped prerequisite job.	.github/workflows/ci.yml .github/workflows/pr_evaluation.yml
Separates Conventional Commit title validation from the general CI workflow.	Adds a dedicated PR title workflow that runs on relevant pull-request lifecycle and edit events. Preserves the allowed commit types and enforces lowercase subjects with a 50-character limit.	.github/workflows/pr-title.yml
Updates release automation for the documented tag-driven release process and stronger publishing security.	Renames the workflow and jobs, upgrades runtime/action pins to Node 24-era versions, and disables release dependency caching. Uses npm trusted publishing with OIDC and provenance checks, retaining a temporary token fallback. Keeps version bumping, package publication, and GitHub release creation as dependent stages, including generated notes and prerelease handling.	.github/workflows/publish.yml .github/workflows/release.yml
Documents repository-specific contribution and release procedures and aligns repository links and runtime requirements.	Adds contribution guidance covering issue-first PRs, title/check requirements, reviews, AI-assisted PRs, no changesets, and frozen packages. Documents tag-based releases, deploy-key bump pushes, trusted publishing, and the no-retag policy. Updates README Node requirements and contributing link, and removes obsolete changeset/changelog files.	CONTRIBUTING.md README.md .changeset/README.md CHANGELOG.md
Adds repository maintenance and ownership configuration.	Assigns all files to the repository code owner. Configures monthly grouped Dependabot updates for GitHub Actions with Conventional Commit-style titles. Adds Docker ignore rules and updates the Docker base image to Node 24.	.github/CODEOWNERS .github/dependabot.yml .dockerignore Dockerfile

Assessment against linked issues

Issue	Objective	Addressed	Explanation
#468	Provide a single required CI gate on pull requests and pushes to main, and run the PR title check in a separate workflow so title or body edits do not rerun CI.	✅
#468	Document repository contribution and release flows, including trusted publishing, and ensure the README and PR template link to CONTRIBUTING.md.	✅
#468	Configure code owners so they are automatically requested for review.	✅

Possibly linked issues

• ci: single CI gate and contribution docs #468: The PR directly delivers the issue’s requested CI checks, contribution docs and links, and automatic code-owner review requests.
• chore: align tooling and hygiene with the org #464: The PR explicitly closes ci: single CI gate and contribution docs #468, an acceptance sub-issue of chore: align tooling and hygiene with the org #464, implementing its CI gate, CONTRIBUTING.md, and CODEOWNERS.
• ci: remove the NPM_TOKEN fallback #471: The PR renames the workflow to release.yml, adds OIDC with an NPM_TOKEN fallback, and creates prerelease-aware GitHub releases with generated notes.

---

Tips and commands

Interacting with Sourcery

• Trigger a new review: Comment @sourcery-ai review on the pull request.
• Continue discussions: Reply directly to Sourcery's review comments.
• Generate a GitHub issue from a review comment: Ask Sourcery to create an
  issue from a review comment by replying to it. You can also reply to a
  review comment with @sourcery-ai issue to create an issue from it.
• Generate a pull request title: Write @sourcery-ai anywhere in the pull
  request title to generate a title at any time. You can also comment
  @sourcery-ai title on the pull request to (re-)generate the title at any time.
• Generate a pull request summary: Write @sourcery-ai summary anywhere in
  the pull request body to generate a PR summary at any time exactly where you
  want it. You can also comment @sourcery-ai summary on the pull request to
  (re-)generate the summary at any time.
• Generate reviewer's guide: Comment @sourcery-ai guide on the pull
  request to (re-)generate the reviewer's guide at any time.
• Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
  pull request to resolve all Sourcery comments. Useful if you've already
  addressed all the comments and don't want to see them anymore.
• Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
  request to dismiss all existing Sourcery reviews. Especially useful if you
  want to start fresh with a new review - don't forget to comment
  @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

• Enable or disable review features such as the Sourcery-generated pull request
  summary, the reviewer's guide, and others.
• Change the review language.
• Add, remove or edit custom review instructions.
• Adjust other review settings.

Getting Help

• Contact our support team for questions or feedback.
• Visit our documentation for detailed guides and information.
• Keep in touch with the Sourcery team by following us on X/Twitter, LinkedIn or GitHub.

[sourcery-ai]

Hey - I've found 2 issues

Prompt for AI Agents

Please address the comments from this code review:

## Individual Comments

### Comment 1
<location path=".github/workflows/ci.yml" line_range="35" />
<code_context>
+        with:
+          persist-credentials: false
+      - name: List files with merge conflict markers
+        run: git --no-pager grep "<<<<<<<" ":(exclude).github/" || true
+      - name: Fail or succeed job if any files with merge conflict markers have been checked in
+        # Find lines containing "<<<<<<<", then count the number of lines.
</code_context>
<issue_to_address>
**Conflict markers pass CI**

When a conflict marker is checked into a `.github/` file, or the number of matching lines outside `.github/` is a positive multiple of 256, `git grep` excludes `.github/`, and `exit $(... | wc --lines)` truncates a positive multiple of 256 to status 0. The conflict job succeeds and CI reports green despite checked-in conflict markers.

Scan files under `.github/` too, and make the job fail whenever the match count is nonzero without using that count as an exit status.

Also at `.github/workflows/ci.yml:39`.
</issue_to_address>

### Comment 2
<location path=".github/dependabot.yml" line_range="9" />
<code_context>
+    directory: /
+    # Pull request titles must be Conventional Commits (PR title check)
+    commit-message:
+      prefix: ci
+    schedule:
+      interval: monthly
</code_context>
<issue_to_address>
**Dependabot PRs fail title checks**

When dependabot opens an update pull request with its generated `Bump ...` subject, or a grouped Actions-update subject exceeds 50 characters, the `ci` prefix leaves the generated subject starting with uppercase `Bump`, which the required PR-title check rejects; grouped Actions-update subjects can also exceed its 50-character limit. Dependabot update PRs cannot pass the required check without manual title edits.

Configure Dependabot-generated titles or the PR-title check so those titles satisfy the required format and length.

Also at `.github/workflows/pr-title.yml:44`.
</issue_to_address>

Sourcery assessment

Needs a human reviewer. 2 findings to address first, and if the changed release workflow builds or selects the wrong package contents, it can publish them to npm under a version that cannot be published again; reverting the workflow would not retract that release from users or downstream consumers. The CI and documentation changes are otherwise reversible.

Blocking findings: .github/workflows/ci.yml:35, .github/dependabot.yml:9

---

Sourcery is free for open source - if you like our reviews please consider sharing them ✨

• X
• Mastodon
• LinkedIn
• Facebook

[sourcery-ai]

Sourcery assessment

Approved.