ci: don't allow breaking changes in PR commit messages

[jamietanna]

Changes

Renovate 44.0.0 was incorrectly released from #44004 due to the
BREAKING ... reference in the commit message.

Renovate uses Squash Merge as our method for merging commits into
main, and when enabled with the Merge Queue[0], this doesn't provide
maintainers with the ability to inspect the commit messages before
merging (which would be the case if not using the Merge Queue, we would
likely rewrite the commit message prior to merge.

With this in mind, Renovate maintainers often don't inspect the commit
messages, allowing them to stay as they are, as they'll be squashed into
the final commit.

In the case of #44004, this led to us missing the BREAKING ...
trailing message - from changes that were split into #44939 - and
because of this, semantic-release published this as a major release.

As a means to prevent this happening again, we can introduce a CI check
that validates - with the same underlying library as semantic-release -
whether a major release is being suggested, and if so, rejecting it.

Tested with: https://github.com/renovatebot/renovate/actions/runs/30451433399/job/90574167521?pr=44943#step:5:11

Context

Please select one of the following:

• This closes an existing Issue, Closes: #
• This doesn't close an Issue, but I accept the risk that this PR may be closed if maintainers disagree with its opening or implementation

AI assistance disclosure

Did you use AI tools to create any part of this pull request?

Please select one option and, if yes, briefly describe how AI was used (e.g., code, tests, docs) and which tool(s) you used.

• No — I did not use AI for this contribution.
• Yes — minimal assistance (e.g., IDE autocomplete, small code completions, grammar fixes).
• Yes — substantive assistance (AI-generated non‑trivial portions of code, tests, or documentation).
• Yes — other (please describe):

Documentation (please check one with an [x])

• I have updated the documentation, or
• No documentation update is required

How I've tested my work (please select one)

I have verified these changes via:

• Code inspection only, or
• Newly added/modified unit tests, or
• No unit tests, but ran on a real repository, or
• Both unit tests + ran on a real repository

The public repository:

[jamietanna]

Should this be bound to the version that semantic-release uses?

[Copilot]

Pull request overview

This PR adds a CI guardrail to prevent PR commit messages from accidentally triggering a major release per Renovate’s existing semantic-release rules, by reusing @semantic-release/commit-analyzer in a standalone check.

Changes:

• Add a new tools/check-major-release.ts script (plus tests) that computes the release type from PR commit messages using .releaserc.json.
• Add a new GitHub Actions job that collects PR commit messages via the GitHub API and fails if a major release would be produced.
• Add @semantic-release/commit-analyzer as a dependency and introduce a local .d.ts shim for its exported function.

Key review findings (blocking)

• The workflow runs node tools/check-major-release.ts, but the script contains TypeScript-only syntax (export type ...). Unless Node is explicitly configured to strip types / load TS in ./.github/actions/setup-node, this step will fail at runtime.
• The script generates synthetic commit hashes; commit-analyzer’s revert filtering (and any hash-based correlation) is most reliable with real SHAs. The workflow currently collects only messages, so reverted breaking commits could still be counted and incorrectly fail CI.
• // Co-authored-by: ... is committed into the source file header; this metadata belongs in git commit trailers, not in repository source.

Reviewed changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
tools/commit-analyzer.d.ts	Adds minimal type declarations for @semantic-release/commit-analyzer so the new tool can be typed.
tools/check-major-release.ts	Implements the release-type computation and CI error reporting based on existing .releaserc.json.
tools/check-major-release.spec.ts	Adds Vitest coverage for major/minor/patch/null cases and offender detection.
package.json	Adds @semantic-release/commit-analyzer dependency needed by the new tool.
pnpm-lock.yaml	Locks the new dependency version.
.github/workflows/check-commit-messages.yml	Adds a new job that collects PR commit messages and runs the major-release check.

Files not reviewed (1)

• pnpm-lock.yaml: Generated file

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[jamietanna]

Replaced by #44944