ci: make the pull request title the release contract

[wayfarer3130]

Why

The release automation read the individual commits, but this repository squash
merges. A squash merge writes one commit to main, and its subject is the
pull request title. The individual commits never reach main, so they cannot
decide the release.

Pull request #1 showed the cost. It carried seven commits, four of them fix:,
and it merged under this title:

chore: publish as @cornerstonejs/jpeg-lossless-decoder-js (#1)

chore releases nothing, so the release workflow published nothing:

run=success
build          -> success
release        -> success
publish        -> skipped
github-release -> skipped

The run reported success, because "nothing to release" is a legitimate
green outcome. Only the registry showed that 2.3.0 never existed. That is the
same trap as a green workflow whose bench job skipped: a run-level success does
not mean the job you care about ran.

What this changes

The title becomes the contract, and the contract becomes visible before a
merge rather than after it.

file	role
tools/conventional.mjs	the rules, in one place
tools/check-pr-title.mjs	reads a title, states the release it produces
.github/workflows/pr-title.yml	runs the check on every pull request
README.md	documents the contract

tools/version.mjs now imports the rules instead of holding its own copy, so
the check and the release cannot disagree about what a subject means.

The check fails a title that is not a conventional subject, fails an unknown
type, and fails a description under 10 characters — the description becomes the
CHANGELOG entry, so it has to say what changed. Otherwise it reports the
outcome:

::notice::This title releases a patch version when it merges.
::notice::"chore" releases no version. That is valid — the merge publishes nothing.

It runs on opened, edited, synchronize and reopened. edited matters
as much as opened: the title is what merges, so a title corrected after
review has to be re-checked, or a stale pass sits on a title nobody checked.

The contract

title	bump
feat!: …, or a BREAKING CHANGE: footer	major
feat: …	minor
fix: …, perf: …	patch
build:, chore:, ci:, docs:, refactor:, revert:, style:, test:	no release
no conventional prefix	rejected before merge

Check one locally:

node tools/check-pr-title.mjs "fix: decode the last sample of a scan"

Script injection

The title reaches the check through the environment, never through the run
script's text. A title is attacker-controlled on a fork pull request, and
${{ ... }} interpolation would paste it into the shell, so a title that holds
$(...) would execute. Verified — this title is read as literal text and
nothing runs:

PR_TITLE='fix: $(touch /tmp/pwned) and `id` here'

This pull request releases nothing, on purpose

ci: is the accurate type: the change adds tools/ and .github/ files, and
tools/ is not in the package's files array. README.md is published, so the
tarball does change, but a documentation change is not a release of the
decoder.

That does leave the publish path still unproven end to end — nothing has yet
published through OIDC trusted publishing. Two honest ways to prove it:

• retitle this pull request to feat: … before merging, which releases 2.3.0.
  The check reports the change as soon as the title is edited;
• or let the next real fix: or feat: prove it.

I did not inflate the type to force a release, because that would undermine the
contract this pull request adds.

Verified

• The lint passes and all 54 tests pass.
• tools/version.mjs behaves as before the refactor.
• The check gives the right answer for nine titles, including feat!: as
  major, chore: as no release, a title with no prefix, an unknown type, and a
  description that is too short.

🤖 Generated with Claude Code

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: bc08b7ef-f52e-4e7b-83fd-e34ac82ece4a

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}