ci: reject a pull request that mixes release classes

[mfal]

Routing only ever sees the PR title. The repo squash-merges, so that title becomes the release commit — which means a branch whose commits carry a higher release class than its title walks straight past the routing guard.

What it catches

Everything below is information the squash merge destroys, because only the title survives.

Case	What is lost
feat: and fix: commits in one PR	one subject cannot tell both; whichever the title omits disappears
a feat: commit under a fix: title	routing sends fix: to main, so the feature lands on the stable line
a breaking commit (! or a BREAKING CHANGE: footer) under a fix:/feat: title	routing sends it to a standing line instead of the major line
a releasing commit under a non-releasing title	the change still ships — relevance is decided by the changed paths — but the changelog announces it as docs/chore, and the commit's own description is discarded
releasing commits across different scopes	fix(List): plus fix(Button): keeps one subject, so the other fix reaches no changelog
a feat: title over nothing but fix: commits	the branch is mislabelled in the other direction — a minor for a patch
a non-releasing title over shipping paths	the fix folded into a docs: commit, where no commit subject says fix at all — #2902 changed two .module.scss files under docs: set max text width

Repeats within one scope are fine: fix(List): a plus fix(List): b is one logical change, and the surviving subject still names it.

What it deliberately allows

• Non-releasing commits mix with anything — a feature with its docs, a fix with its test, chore/ci/refactor/style alongside either.
• A commit whose subject is not a Conventional Commit is ignored. wip, review feedback, fixup! … and merge commits are normal on a branch; failing on them would make this a nuisance rather than a gate. An unknown type (wip(List): …) counts as unparsable, not as non-releasing.
• A docs-only branch may still be titled fix:. Whether that releases anything is a different question — the path-based release gate answers it.
• Promotion and sync sources are exempt, the same heads routing and the version contract already exempt (next, x.x, sync/*, release/*): they carry every class by design (ADR 0004 §8).

The paths, in one direction

The last row needs more than the commit subjects, so the job runs the release gate's own classifier and fails when the changed paths reach a consumer while the title's type does not. The remedy is a releasing type with the same scope — fix(docs): add a migration entry says both things at once: it ships, and it is documentation. No tag, no second vocabulary.

Checked in one direction only. A fix(docs): title over paths that reach nobody costs nothing — the paths decide whether anything publishes, and fix(docs): for a docs-app fix is honest (#3020, #2993). Dependabot's generated *(deps) titles are exempt: a group is not homogeneous in effect and commit-message.prefix is per ecosystem, so no title it can produce would be true for all of it.

Over main since #2933 this half fires on 7 of 81 conventional merges — #2902, #3016 and #3062 (genuinely mislabelled), #3000 (a build config plus a dependency patch under test:), #2954 (honest docs that ships components/AGENTS.md, so it wants fix(docs):), and #2929 and #3013 where the classifier stays deliberately fail-safe.

Shape

Follows the existing guard pattern in this repo — a pure lib, an IO shell, and a self-test the job runs before it:

• .github/scripts/commit-mixture-lib.mjs — classifyCommit and classifyMixture, no git, no IO
• .github/scripts/commit-mixture-guard.mjs — reads git log -z --format=%s%n%b, writes ::error:: per offending commit
• .github/scripts/commit-mixture-lib.test.mjs — 16 tests
• a commit-mixture job in commit-guard.yml, gated to PRs against main/next

-z rather than a textual record delimiter, because a commit body can contain any text but not a NUL.

Verified

All 16 lib tests plus the real shapes through the guard end to end: feat+fix mixed fails naming both commits, a feat under a fix title fails as smuggling, a BREAKING CHANGE: footer under a fix title fails, a fix under a docs title fails naming the changelog consequence, two fixes in different scopes fail naming the scopes, two fixes in the same scope pass, feat + docs + wip passes, and a docs-only branch titled fix(docs): passes.

Merge after #3098

This was reviewed as #3102 and merged into the #3098 branch rather than into main; #3098 has now been pulled apart, and this is its own line, rebased onto current main.

It still depends on #3098, which sharpens the path classifier this guard runs:

• a package's root Markdown judged against its files, and Dockerfile/.dockerignore in the package-local denylist — without those, the path half would fire on test(remote-react-components): extract the scenario-focus wait into a documented lib #3009 and ci: build the preview apps in CI and let the image only package them #3008, which reach nobody;
• the MANIFEST_SNAPSHOT_DIR protocol the Classify the changed paths step uses. Today's classifier reads ROOT_MANIFEST_* instead and ignores the snapshot dir, so until fix(ci): stop publishing on paths that cannot reach a consumer #3098 lands the manifest key-diff refinement is inert here and the classification stays conservative.

Independent of #3137 (the changelog preset) — no shared files.

🤖 Generated with Claude Code

[github-actions]

Coverage Report for ./packages/components/

Status	Category	Percentage	Covered / Total
🔵	Lines	78.68%	779 / 990
🔵	Statements	78.59%	797 / 1014
🔵	Functions	79.82%	178 / 223
🔵	Branches	70.62%	404 / 572

File Coverage

No changed files found.

Generated in workflow #6714 for commit 46741dd by the Vitest Coverage Report Action

[github-actions]

🚀 Preview Deployment

Preview environments are ready:

Type	URL
docs	pr-3138.docs.review.flow-components.de
storybook	pr-3138.storybook.review.flow-components.de

Images:

• docs: ghcr.io/mittwald/flow/docs:pr-3138
• storybook: ghcr.io/mittwald/flow/storybook:pr-3138