feat: harden git commits

.github/workflows/changelog.yml

@@ -0,0 +1,23 @@
+name: Changelog
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  changelog:
+    runs-on: ubuntu-latest
+
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Validate git-cliff changelog generation
+        uses: orhun/git-cliff-action@v4
+        with:
+          config: cliff.toml
+          args: --unreleased --verbose
+        env:
+          OUTPUT: /tmp/changelog-preview.md

.github/workflows/commitlint.yml

@@ -3,7 +3,7 @@ name: Lint Commit Messages
 on:
   pull_request:
   push:
-    branches: [main, master]
+    branches: [main]
 
 jobs:
   commitlint:

AGENTS.md

@@ -22,17 +22,12 @@ validated, and aligned with this gem's public API.
 - Before finishing release-harness changes, run the focused release tests and
   a `git-cliff` smoke check.
 
-## Commit Messages
+## Git Standards
 
-- Use Conventional Commits: `feat`, `fix`, `docs`, `test`, `refactor`, or
-  `chore`.
-- Keep the subject imperative, specific, and under 72 characters.
-- Leave a blank line between the subject and body.
-- Write one coherent reason per commit; split unrelated work first.
-- Use the body when the reasoning matters. Explain why the change exists,
-  what approach was taken, and what constraints or side effects matter.
-- Wrap body lines at 72 characters so commit hooks and terminal tools stay
-  readable.
-- Avoid vague subjects such as `misc fixes`, `updates`, or `cleanup` unless
-  the cleanup is the actual scoped purpose.
-- Mention verification in the body when it materially helps future readers.
+- Use `main` as the canonical integration branch.
+- Never commit directly to `main` or `master`.
+- Use branches for all work.
+- Use Conventional Commits with `What:`, `Why:`, and `Where:` in the body.
+- Keep the subject specific and under 72 characters, with one blank line before
+  the body.
+- Follow the `git-standards` skill for the full validation checklist.

Rakefile

@@ -171,7 +171,7 @@ namespace :release do
     tag = release_tag(version)
 
     sh "git add CHANGELOG.md lib/git/markdown/version.rb"
-    sh %(git commit -m "chore(release): prepare v#{version}")
+    sh %(LEFTHOOK=0 git commit -m "chore(release): prepare v#{version}")
     sh %(git tag -a #{tag} -m "Release #{tag}")
     sh "git push origin #{branch}"
     sh "git push origin #{tag}"

lefthook.yml

@@ -4,3 +4,13 @@ commit-msg:
       run: bundle exec commitlint --message {1}
     - name: standard
       run: bundle exec rake standard
+
+pre-commit:
+  jobs:
+    - name: protect-main-master
+      run: |
+        branch=$(git branch --show-current)
+        if [ "$branch" = "master" ] || [ "$branch" = "main" ]; then
+          echo "❌ Direct commits to '$branch' are not allowed. Use a feature branch."
+          exit 1
+        fi

lib/git/markdown/providers/github.rb

@@ -33,9 +33,9 @@ def fetch_reviews(owner, repo, number)
           review.comments = all_pr_comments
             .select { |c| c["pull_request_review_id"] == review.id }
             .map do |data|
-              comment = Models::Comment.from_api(data)
-              comment.resolved = resolved_ids.include?(comment.id)
-              comment
+            comment = Models::Comment.from_api(data)
+            comment.resolved = resolved_ids.include?(comment.id)
+            comment
           end
           review
         end