ci: Reset CI workflow permissions

.github/dependabot.yml

@@ -4,13 +4,17 @@ updates:
   directory: "/"
   schedule:
     interval: "weekly"
+  cooldown:
+    default-days: 2
   commit-message:
     prefix: "ci(github-actions)"
 - package-ecosystem: npm
   directory: "/"
   schedule:
-    interval: "daily"
+    interval: "weekly"
   versioning-strategy: increase
+  cooldown:
+    default-days: 2
   commit-message:
     prefix: "deps"
     prefix-development: "build(deps-dev)"

.github/workflows/ci.yml

@@ -7,15 +7,17 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+# No permissions are required for this workflow
+permissions: {}
 
 jobs:
   test:
     name: General checks
     runs-on: ubuntu-22.04
     steps:
     - uses: actions/checkout@v6
+      with:
+        fetch-depth: 0
     - name: Use Node.js 22
       uses: actions/setup-node@v6
       with:
@@ -27,6 +29,14 @@ jobs:
     - name: Perform Prettier check
       run: npm run prettier:check
 
+    - name: Validate current commit (last commit) with commitlint
+      if: github.event_name == 'push'
+      run: npm run lint:commit -- --last --verbose
+
+    - name: Validate PR commits with commitlint
+      if: github.event_name == 'pull_request'
+      run: npm run lint:commit -- --from ${{ github.event.pull_request.base.sha }} --to ${{ github.event.pull_request.head.sha }} --verbose
+
     - name: Perform Licenses check
       run: npm run check-licenses
 

.github/workflows/release-please.yml

@@ -12,8 +12,9 @@ permissions:
 jobs:
   pull-request:
     runs-on: ubuntu-24.04
+    environment: release
     steps:
-    - uses: googleapis/release-please-action@v5
+    - uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
       id: release
       with:
         token: ${{secrets.GH_OPENUI5BOT}}

.github/workflows/reuse-compliance.yml

@@ -8,8 +8,8 @@ on:
     branches:
       - main
 
-permissions:
-  contents: read
+# No permissions are required for this workflow
+permissions: {}
 
 jobs:
   compliance-check:
@@ -18,4 +18,4 @@ jobs:
     steps:
     - uses: actions/checkout@v6
     - name: Execute REUSE Compliance Check
-      uses: fsfe/reuse-action@v6
+      uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0

.husky/commit-msg

@@ -0,0 +1 @@
+npm run lint:commit -- --edit "$1" # Lint currently edited commit message

.npmrc

@@ -2,3 +2,4 @@
 registry=https://registry.npmjs.org/
 lockfile-version=3
 ignore-scripts=true
+allow-git=none

package.json

@@ -26,8 +26,7 @@
   "scripts": {
     "check-licenses": "licensee --errors-only",
     "knip": "knip",
-    "hooks:pre-push": "npm run lint:commit",
-    "lint:commit": "commitlint -e",
+    "lint:commit": "commitlint",
     "prepare": "node ./.husky/skip.js || husky",
     "prettier": "prettier **/.mcp.json **/plugin.json",
     "prettier:write": "npm run prettier -- --write",