ci: load commitlint.config.ts and exempt Dependabot commits

wagoid/commitlint-github-action@v6 defaults configFile to ./commitlint.config.mjs, which
this repo has never had (it uses commitlint.config.ts) -- per the action's own documented
fallback, a missing configFile silently loads bare @commitlint/config-conventional instead,
meaning this repo's own type-enum restriction has never actually been enforced in CI, and
the Dependabot exemption added in this same commit would have had no effect without it.
dependabot-auto-merge.yml lands Dependabot's rebase-merged commits on main verbatim,
including its generated Bumps/Release notes/Changelog body, which routinely contains a
markdown link line over the inherited body-max-line-length limit and cannot be reformatted
by this repo -- the ignores predicate skips linting entirely for those commits, identified
by the Signed-off-by: dependabot[bot] trailer fetch-metadata's auto-merge always appends,
while every rule stays fully enforced for human-authored commits. Verified via the real
commitlint CLI: a synthetic Dependabot message with an over-length body line now passes,
an invalid type on a human commit still correctly fails, and a human commit with an
over-length body line still correctly fails.

Author: Mearman

.github/workflows/ci.yml

@@ -19,6 +19,8 @@ jobs:
         with:
           fetch-depth: 0
       - uses: wagoid/commitlint-github-action@v6
+        with:
+          configFile: ./commitlint.config.ts
 
   lint:
     name: Lint

commitlint.config.ts

@@ -5,4 +5,6 @@ export default {
   rules: {
     'type-enum': [2, 'always', commitTypes.map((t) => t.type)],
   },
+  // dependabot-auto-merge.yml lands Dependabot's rebase-merged commits on main verbatim, including its generated Bumps/Release notes/Changelog body, which routinely contains a markdown link line over the inherited body-max-line-length limit and cannot be reformatted by this repo. Skip linting entirely for those commits, identified by the "Signed-off-by: dependabot[bot]" trailer that fetch-metadata's auto-merge always appends, while leaving every rule fully enforced for human-authored commits.
+  ignores: [(message: string) => /^Signed-off-by: dependabot\[bot\]/m.test(message)],
 };