From c8c4585e760b7088e898f831f5266470d7382100 Mon Sep 17 00:00:00 2001
From: dev lithastra <dev@lithastra.com>
Date: Sun, 9 Aug 2026 22:50:39 +0900
Subject: [PATCH 1/2] ci: enforce backstage contribution gates

Signed-off-by: dev lithastra <dev@lithastra.com>
---
 .github/workflows/ci.yml | 48 ++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7ca677f..c930896 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -9,6 +9,54 @@ on:
   pull_request:
 
 jobs:
+  commitlint:
+    name: Commit messages follow Conventional Commits
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-node@v7
+        with:
+          node-version: '20'
+      - run: npm install --no-save @commitlint/cli@19 @commitlint/config-conventional@19
+      - name: Validate PR title
+        if: github.event_name == 'pull_request'
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: printf '%s\n' "$PR_TITLE" | npx commitlint --extends '@commitlint/config-conventional'
+      - name: Validate commits in PR
+        if: github.event_name == 'pull_request'
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: npx commitlint --from "$BASE_SHA" --to "$HEAD_SHA" --verbose
+
+  dco-check:
+    name: All commits signed off (DCO)
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+      - name: Verify Signed-off-by on each commit
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: |
+          set -e
+          missing=$(git log --format='%H %s' "${BASE_SHA}..${HEAD_SHA}" | while read -r sha rest; do
+            if ! git log -1 --format=%B "$sha" | grep -q '^Signed-off-by: '; then
+              echo "$sha"
+            fi
+          done)
+          if [ -n "$missing" ]; then
+            echo "::error::The following commits are missing a Signed-off-by line:"
+            echo "$missing"
+            exit 1
+          fi
+
   build:
     name: lint + tsc + test + build
     runs-on: ubuntu-latest

From 52f37b3aba5ab79e6e469679ddf2119e837908d9 Mon Sep 17 00:00:00 2001
From: dev lithastra <dev@lithastra.com>
Date: Sun, 9 Aug 2026 22:52:21 +0900
Subject: [PATCH 2/2] fix(ci): load commitlint rules

Signed-off-by: dev lithastra <dev@lithastra.com>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c930896..8688de6 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -30,7 +30,7 @@ jobs:
         env:
           BASE_SHA: ${{ github.event.pull_request.base.sha }}
           HEAD_SHA: ${{ github.event.pull_request.head.sha }}
-        run: npx commitlint --from "$BASE_SHA" --to "$HEAD_SHA" --verbose
+        run: npx commitlint --extends '@commitlint/config-conventional' --from "$BASE_SHA" --to "$HEAD_SHA" --verbose
 
   dco-check:
     name: All commits signed off (DCO)