From 34194406bee6bcf4e43329a2dc39809c77a9cfc8 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 17 Jul 2026 06:56:48 +0000
Subject: [PATCH] ci: unblock dependabot PRs and build the website in PR CI
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Dependabot's generated messages ("Bump …" subject, long metadata body) fail
the commitlint gate on every update PR, so exempt them via an ignores entry
in commitlint.config.mjs — normal commits are still checked.

Ignore TypeScript major bumps in dependabot.yml: the site builds on 5.x but
fails on 7.0.2 (the native-compiler rewrite), so that migration should be
deliberate rather than a routine weekly bump.

Add site-ci.yml to build the website on PRs touching website/**. Today only
pages.yml builds the site, and only on push to main — a dependabot PR that
breaks the build (like the current typescript 7 bump) passes all PR checks.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NRxAm6DG11WGYLWXU2AgP3
---
 .github/dependabot.yml        |  6 ++++++
 .github/workflows/site-ci.yml | 36 +++++++++++++++++++++++++++++++++++
 commitlint.config.mjs         |  5 +++++
 3 files changed, 47 insertions(+)
 create mode 100644 .github/workflows/site-ci.yml

diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 8fbfdda..d99754e 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -31,3 +31,9 @@ updates:
         patterns: ["*"]
     commit-message:
       prefix: "build(deps)"
+    ignore:
+      # TypeScript 7 is the native-compiler rewrite and breaks `next build`
+      # (verified: the site builds on 5.x, fails on 7.0.2). Migrate to it
+      # deliberately, not via a routine deps bump.
+      - dependency-name: typescript
+        update-types: ["version-update:semver-major"]
diff --git a/.github/workflows/site-ci.yml b/.github/workflows/site-ci.yml
new file mode 100644
index 0000000..c15b7bd
--- /dev/null
+++ b/.github/workflows/site-ci.yml
@@ -0,0 +1,36 @@
+name: Site CI
+
+# Build the website on pull requests that touch it, so a broken build is
+# caught before merge — pages.yml only builds on push to main, which would
+# otherwise be the first time a bad website change fails.
+on:
+  pull_request:
+    paths: ["website/**", ".github/workflows/site-ci.yml"]
+
+permissions:
+  contents: read
+
+concurrency:
+  group: site-ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    name: website build
+    runs-on: ubuntu-latest
+    defaults:
+      run:
+        working-directory: website
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v6
+        with:
+          node-version: "22"
+          cache: npm
+          cache-dependency-path: website/package-lock.json
+      - run: npm ci
+      # Same base path as the pages.yml deploy build, so the two can't drift.
+      - name: Build static site
+        run: npm run build
+        env:
+          PAGES_BASE_PATH: /tarjan
diff --git a/commitlint.config.mjs b/commitlint.config.mjs
index 64f8c44..35e82e7 100644
--- a/commitlint.config.mjs
+++ b/commitlint.config.mjs
@@ -4,6 +4,11 @@
 // .githooks/commit-msg (enable with `make hooks`).
 export default {
   extends: ["@commitlint/config-conventional"],
+  // Dependabot's generated messages ("build(deps): Bump …") use a capitalized
+  // subject and long metadata lines in the body, neither of which can be
+  // changed via dependabot.yml — exempt them instead of failing every update
+  // PR. The type/scope prefix itself is still set in .github/dependabot.yml.
+  ignores: [(message) => /^(build|ci)\(deps[^)]*\): bump /i.test(message)],
   rules: {
     // Keep in sync with .githooks/commit-msg.
     "header-max-length": [2, "always", 100],