chore(ci): consolidate commitlint into ci.yaml and share setup composite

.github/actions/setup/action.yaml

@@ -1,5 +1,11 @@
 name: setup
-description: Setup mise, node, and pnpm.
+description: Setup mise (node, pnpm, actionlint, ...). Optionally install pnpm dependencies.
+
+inputs:
+  install:
+    description: 'Run `pnpm install --frozen-lockfile` and prime the pnpm store cache. Set to "false" for jobs that only need binaries from mise.'
+    required: false
+    default: 'true'
 
 runs:
   using: composite
@@ -8,16 +14,19 @@ runs:
 
     - name: Get pnpm store directory
       id: pnpm-store
-      run: echo "path=$(pnpm store path)" >> "$GITHUB_OUTPUT"
+      if: inputs.install == 'true'
       shell: bash
+      run: echo "path=$(pnpm store path)" >> "$GITHUB_OUTPUT"
 
     - name: Cache pnpm store
+      if: inputs.install == 'true'
       uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
       with:
         path: ${{ steps.pnpm-store.outputs.path }}
         key: pnpm-store-${{ runner.os }}-${{ hashFiles('**/pnpm-lock.yaml') }}
         restore-keys: |
           pnpm-store-${{ runner.os }}-
 
-    - run: pnpm i --frozen-lockfile
+    - if: inputs.install == 'true'
       shell: bash
+      run: pnpm i --frozen-lockfile

.github/workflows/actionlint.yaml

@@ -28,9 +28,9 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      # Not using ./.github/actions/setup: actionlint is a standalone binary
-      # and the composite's pnpm install is unnecessary here.
-      - uses: jdx/mise-action@1648a7812b9aeae629881980618f079932869151 # v4.0.1
+      - uses: ./.github/actions/setup
+        with:
+          install: 'false'
 
       - name: Run actionlint
         run: actionlint -color

.github/workflows/ci.yaml

@@ -11,7 +11,29 @@ on:
       - main
       - 'releases/*'
 
+permissions:
+  contents: read
+
 jobs:
+  commitlint:
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: read
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          fetch-depth: 0
+
+      - uses: ./.github/actions/setup
+
+      - name: Commitlint
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+        run: pnpm exec commitlint --from="$BASE_SHA" --to="$HEAD_SHA" --verbose
+
   build_and_test:
     runs-on: ubuntu-latest
     steps: