feat(devtools): move this repo to mise and lefthook's shared rules

.commitlintrc.yaml

@@ -0,0 +1,11 @@
+# Conventional Commits for this repo: commitlint's conventional config, plus the scopes
+# AGENTS.md documents. A scope stays optional, but an invented one is rejected, so the
+# two lists cannot drift apart.
+#
+# The commit-msg hook reads this file. So does ci-pr, on the pull request title and on
+# every commit.
+extends:
+  - '@commitlint/config-conventional'
+
+rules:
+  scope-enum: [2, always, [actions, workflows, devtools, templates, docs, deps]]

.github/workflows/self-lint.yml

@@ -1,9 +1,10 @@
 name: self-lint
 
-# Dogfooding caller: runs the ci-workflows library workflow (actionlint, zizmor,
-# shellcheck) against this repo's own source, which is the strongest proof it works
-# before a consumer pins @v1. Adds the checks that are specific to this repo and are
-# not part of the exported library.
+# Dogfooding caller: runs the ci-lint library workflow against this repo's own source,
+# which is the strongest proof it works before a consumer pins @v1. ci-lint runs this
+# repo's lefthook pre-commit hook over every file: Prettier, actionlint, zizmor,
+# shellcheck and the first-party pin check. Adds the tests that are specific to this
+# repo and are not part of the exported library.
 
 on:
   pull_request:
@@ -16,24 +17,33 @@ concurrency:
   cancel-in-progress: true
 
 jobs:
-  # Dependabot only ever bumps a pinned SHA or a devDependency, and it vets what it
+  # Dependabot only ever bumps a pinned SHA or a dependency, and it vets what it
   # opens; running the full lint suite on those adds latency without adding signal.
-  workflows:
+  lint:
     if: ${{ !startsWith(github.head_ref, 'dependabot/') }}
     permissions:
       contents: read
     # zizmor prefers `$/` over `./`, because a workspace-relative ref can load
     # something a previous step cloned at runtime. That risk is real for a step-level
-    # action ref -- it is why the actions above moved to `$/` -- but not for a
-    # job-level reusable-workflow call, which GitHub resolves when the run is queued,
-    # never from the workspace. `./` buys something concrete in exchange: actionlint
-    # validates a local call against the callee's declarations (it catches an input
-    # name that does not exist, and lists the ones that do), while `$/` it cannot
-    # parse at all, so the call would go unchecked. Keeping the validation.
+    # action ref -- it is why the actions moved to `$/` -- but not for a job-level
+    # reusable-workflow call, which GitHub resolves when the run is queued, never from
+    # the workspace. `./` buys something concrete in exchange: actionlint validates a
+    # local call against the callee's declarations (it catches an input name that does
+    # not exist, and lists the ones that do), while `$/` it cannot parse at all, so the
+    # call would go unchecked. Keeping the validation.
+    uses: ./.github/workflows/ci-lint.yml # zizmor: ignore[self-repository]
+
+  # ci-workflows is the library for repos with no lefthook config. Nothing else here
+  # calls it, so this is its only test.
+  workflows:
+    if: ${{ !startsWith(github.head_ref, 'dependabot/') }}
+    permissions:
+      contents: read
     uses: ./.github/workflows/ci-workflows.yml # zizmor: ignore[self-repository]
 
   repo-checks:
     if: ${{ !startsWith(github.head_ref, 'dependabot/') }}
+    # The name is a required check in rulesets/checks-dotgithub.json; change both together.
     name: Pins and formatting
     runs-on: ubuntu-latest
     timeout-minutes: 10
@@ -51,20 +61,11 @@ jobs:
       - name: Check first-party action pins
         run: sh .devtools/check-action-pins.sh
 
-      # ci-pr only exercises these scripts with a pull request's arguments. The
-      # pre-commit hooks call them with none, and that path is tested here.
       # The same install ci-pr does, so the test below runs the commitlint consumers get.
       - name: Install commitlint for pr-checks
         run: npm ci --prefix .github/actions/pr-checks --ignore-scripts --no-audit --no-fund
 
+      # ci-pr only exercises these scripts with a pull request's arguments. The git
+      # hooks call them with none, and that path is tested here.
       - name: Test the check scripts
         run: bash .devtools/test-hooks.sh
-
-      - name: Enable pnpm via corepack
-        run: corepack enable
-
-      - name: Install the toolchain
-        run: pnpm install --frozen-lockfile
-
-      - name: Check formatting
-        run: pnpm run format:check