The pull request has only one (non-merge) commit and in this case Github will use it as the default commit message when merging. The pull request title doesn't match the commit though ("ci: harden CI/CD security" vs. "ci: harden CI/CD security — SHA pins, permissions, zizmor, dependabot"). Please update the pull request title accordingly to avoid surprises.