Validate pull request titles and commits, and scan with CodeQL #24

Parent

#21

What to build

A script checks a pull request title, or every commit in a range, against the conventional-commit types release-please reads, and explains the expected shape when one does not match. A workflow runs it on every pull request, and a contributor runs the same script locally before pushing, so the workflow enforces nothing that cannot be reproduced on a laptop.

The local git hooks work again. The estate's commit-msg and pre-push hooks are vendored unchanged, so the existing install script finds them, and a test keeps the commit types the hook accepts equal to the ones the script accepts.

CodeQL analyses the JavaScript and TypeScript and the workflows with the security-and-quality suite, on pull requests and weekly, outside the gate.

Acceptance criteria

• A pull request with a non-conventional title fails the validation workflow with an explanation, and a conventional title passes.
• The release-please pull request title and Dependabot's commit subjects pass.
• The hook install script installs both hooks on a fresh clone.
• The types test fails when the hook and the script disagree.
• CodeQL results appear in the repository's security tab.

Blocked by

• Run the suite on Vitest and make the tooling strict TypeScript #22