[ss-o]

Summary

• Adds .github/workflows/commit-lint.yml, a thin caller for the organization commit-lint suite in z-shell/.github (Conventional Commit messages and PR title, banned bot/AI-agent Co-authored-by trailers, branch-name shape, ADR-0022 issue link).
• Pinned to z-shell/.github main at 6ab97b2, with permissions: contents: read on both the workflow and the job (fix(ci): Lint Commits fails at startup so commit policy is unenforced .github#575).

Verification

• actionlint .github/workflows/commit-lint.yml is clean.
• The commit carries no trailer, and this PR is its own first run of the caller.

Agent handoff

No handoff needed.

Closes #26

[ss-o]

Trunk Code Quality fails on this PR with pinact/parse-error at .github/workflows/commit-lint.yml:27: "SHA-pinned action requires a version comment for verifiability". The # main comment is not a version.

This failure is not new. main has failed Trunk Code Quality since at least 2026-09-11 (head aff1e35), because the existing trunk-check.yml:28 caller has the same @<sha> # main shape, and trunk-check.yml:25 has a second pinact error. zunit is one of only two repositories with pinact enabled (zpmod is the other, and it runs no Trunk workflow in CI), so the other eleven commit-lint caller PRs pass.

The fix belongs with z-shell/.github#543 (version the reusable workflows with immutable releases, so a caller can pin @<sha> # vX.Y.Z), not with a per-line suppression here. All four Policy checks, zsh-n, Zsh Lint and zunit pass.

[ss-o]

Fallback review under ADR-0026: Copilot request not registered on 5aba0e8

Reviewed under .github/skills/code-review/SKILL.md against code-review-generic.instructions.md (packaging/CI checks: permissions, immutable pins, secret handling, whether validation publishes or mutates anything).

Findings: none.

• The diff adds .github/workflows/commit-lint.yml: a thin workflow_call caller of z-shell/.github/.github/workflows/commit-lint.yml, pinned to the full SHA 6ab97b23 (current z-shell/.github main), with the org # main comment (PATTERNS.md).
• Permissions are contents: read at the workflow and job level. The called jobs declare permissions: {} and use no secrets, so no token scope is widened.
• There is deliberately no caller-level concurrency, which avoids the deadlock with the called workflow's own group. It triggers only on pull_request to main, with no publication or write side effects.
• .pinact.yaml ignores only z-shell/.github/.github/workflows/.* and only at a full 40-hex ref, so the SHA-pin requirement still holds for those workflows and pinact still checks every other action. pinact 4.1.1 run --check is clean on both reusable-workflow callers; Trunk Code Quality now passes on this head.
• Not in this diff: test-matrix.yml:25 pins docker/setup-buildx-action to a SHA that does not exist upstream. That is pre-existing on main and is tracked separately.
• Evidence: actionlint is clean, the branch is 0 commits behind main, the commit has no trailer, and the Policy jobs pass on this PR, so the caller exercises itself.

[ss-o]

Correction to the fallback review above: its opening line says "Copilot request not registered", but no Copilot request was made on this pull request. The maintainer chose the ADR-0026 fallback review for the class 2-4 commit-lint callers up front, to save review allowance. The review's findings and evidence stand; only the stated trigger was wrong. ADR-0026 has no clause for a maintainer-elected fallback yet; that gap is tracked in z-shell/.github#664.