release-please derives the changelog and the version bump from
conventional-commit subjects read off main. Squash-merging takes the
subject from the PR title, so a title the parser cannot read drops the
change from the release notes with no warning. The build-identity
feature (#1899) merged with an untyped title and never appeared in any
release notes.
The local commit-msg hook cannot catch this: it runs against the PR
branch commit and never against the squash that actually lands. Add a
pull_request workflow that validates the title, and read the allowed
types from commitlint.config.js so the two cannot drift.
The check enforces the conventional shape only, not the length or
casing rules the local hook applies to a full commit. Those would only
add noise here: Dependabot generates group titles longer than the
commit header limit, and blocking on that would fail a PR whose title is
otherwise fine.
Correct CONTRIBUTING.md while here. It claimed that hand edits to the
Release PR survive a regeneration; release-please replaces the PR body
and force-pushes the release branch, so they do not. Point the guidance
at the override block, and record that a dependency PR clearing an
advisory must not merge as chore(deps), which is conventional and
therefore passes the new check while staying out of the changelog.
Anso