ci: split PR linting into separate workflow

- pr-title.yml runs on pull_request_target and checks the PR title
- ci.yml::commitlint runs on push to main only and expects commits to be squashed
- ci.yml::[lint,test] run on push + pull_request for all

Author: seansica

.github/workflows/ci.yml

@@ -8,53 +8,30 @@ on:
 
 permissions:
   contents: read
-  pull-requests: read
 
 jobs:
-  # For PRs, validate the PR title (which becomes the squash commit message).
-  # This avoids burdening external contributors with conventional commit enforcement
-  # on every individual commit. See: https://www.conventionalcommits.org/en/v1.0.0/
-  #
-  # For pushes to main, validate the final commit message (the squash merge commit)
-  # using commitizen as a safety net.
+  # Validate the squash merge commit message on pushes to main.
+  # PR title validation is handled separately in pr-title.yml.
   commitlint:
+    if: github.event_name == 'push'
     runs-on: ubuntu-latest
     steps:
-      # PR: validate PR title follows conventional commit format
-      - name: Validate PR title
-        if: github.event_name == 'pull_request'
-        uses: amannn/action-semantic-pull-request@v5
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        with:
-          # For work-in-progress PRs you can typically use draft pull requests from GitHub. 
-          # This action allows us to use the special "[WIP]" prefix to indicate a draft state 
-          # without actually flagging the PR as a draft.
-          # Example:
-          # `[WIP] feat: Add support for Node.js 18` <--- will not be validated!
-          wip: true
-
-      # Push to main: validate the squash merge commit message directly
       - name: Checkout
-        if: github.event_name == 'push'
         uses: actions/checkout@v6
         with:
           fetch-depth: 2
 
       - name: Install uv
-        if: github.event_name == 'push'
         uses: astral-sh/setup-uv@v7
         with:
           version: "latest"
 
       - name: Install Python and dependencies
-        if: github.event_name == 'push'
         run: |
           uv python install 3.11
           uv sync --all-extras
 
       - name: Validate commit message
-        if: github.event_name == 'push'
         run: uv run cz check --rev-range HEAD~1..HEAD
 
   lint:

.github/workflows/pr-title.yml

@@ -0,0 +1,36 @@
+name: PR Title
+
+# Validate that PR titles follow Conventional Commits format.
+# Since we squash merge PRs, the PR title becomes the merge commit message,
+# which Python Semantic Release uses to determine version bumps.
+#
+# This avoids burdening external contributors with conventional commit enforcement
+# on every individual commit. See: https://www.conventionalcommits.org/en/v1.0.0/
+#
+# NOTE: pull_request_target is used instead of pull_request because it runs in the
+# context of the base branch and has reliable access to the GITHUB_TOKEN for reading
+# PR metadata.
+
+on:
+  pull_request_target:
+    types: [opened, edited, synchronize, reopened]
+    branches: [main]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate PR title
+        uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          # For work-in-progress PRs you can typically use draft pull requests from GitHub.
+          # This action allows us to use the special "[WIP]" prefix to indicate a draft state
+          # without actually flagging the PR as a draft.
+          # Example:
+          # `[WIP] feat: Add support for Node.js 18` <--- will not be validated!
+          wip: true