fix: repair PR title check, bump actions, fix CODEOWNERS

[bellini666]

PR title check

The check has failed on every human-authored PR since 2026-06-26, and PRs merged straight through it (blb-ventures/veroo#2187).

beemojs/conventional-pr-action installed conventional-changelog-angular@latest and resolved it through enhanced-resolve, which matches the node condition. v9.0.0 narrowed the package's exports to types + import only, so resolution now fails with Package path . is not exported. The action pins no version, exposes no way to change the resolver conditions, and has had no commits since 2024-05. Its last release was itself a fix for this same error.

Replaced it with amannn/action-semantic-pull-request, which reads the title from the API and validates it directly. No preset package, no npm install, no floating dependency, and no checkout/setup-node steps. It also drops the angular preset, which never matched the @commitlint/config-conventional the repos actually lint commits against.

Action bumps

action	from	to
actions/checkout	v6	v7
actions/cache	v5	v6
actions/setup-node	v6	v7
actions/labeler	v5	v6
actions/upload-artifact	v4	v7
actions/add-to-project	v1.0.2	v2.0.0
astral-sh/setup-uv	v7	v8.3.2
docker/build-push-action	v6	v7
docker/login-action	v3	v4
docker/setup-buildx-action	v3	v4
jakebailey/pyright-action	v2	v3
googleapis/release-please-action	v4	v5

Mostly Node 24 runtime bumps that need no YAML change. Two exceptions:

• setup-uv is pinned exactly because v8 stopped publishing floating major tags; @v8 does not resolve.
• checkout v7 rejects fork-PR checkouts under pull_request_target/workflow_run without allow-unsafe-pr-checkout. No workflow here uses those triggers, but callers of these reusable workflows inherit their own github.event_name, so a consumer doing that would need the opt-in.

pnpm/action-setup stays on v4 deliberately. v6 bootstraps pnpm and self-updates to the target, which crashes when the target's dep tree carries a peer variant (pnpm/pnpm#12959, still open). v4 installs directly and is unaffected.

CODEOWNERS

/ never matched anything, so the repo had no owners at all. GitHub's API flags it:

the pattern / will never match any files - did you mean * instead?

Dependabot

Grouped into a single PR, with a 7-day cooldown and labels, matching veroo's config. Four dependabot PRs from 2023 (#6 #7 #8 #9) are still open and conflicting; since dependabot won't raise a new PR while one is open for the same dependency, those four have been blocking setup-node, labeler, setup-python, and release-please updates ever since. The bumps here supersede all four, so they should auto-close.

Worth a look separately: no dependabot PR has been raised in this repo since 2023-12 despite interval: weekly, which the config alone does not explain.

[Copilot]

Pull request overview

Updates this shared .github repository’s automation to restore reliable PR-title validation, modernize GitHub Action dependencies, and fix repository ownership/config hygiene.

Changes:

• Replaced the broken PR title validation step (beemojs/conventional-pr-action) with amannn/action-semantic-pull-request.
• Bumped multiple GitHub Actions across reusable workflows (e.g., actions/checkout@v7, actions/setup-node@v7, actions/cache@v6, Docker actions, release-please).
• Fixed CODEOWNERS to apply to all files and enhanced Dependabot configuration (labels, grouping, cooldown).

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
CODEOWNERS	Fixes ownership matching by applying an all-files pattern.
.github/workflows/pr.yaml	Repairs PR title checking by switching to action-semantic-pull-request and updates actions/labeler.
.github/workflows/test-web.yaml	Bumps checkout/setup-node/upload-artifact action versions used in web testing workflow.
.github/workflows/test-back.yaml	Bumps checkout/cache/setup-uv/pyright action versions used in backend testing workflow.
.github/workflows/test-app.yaml	Bumps checkout/setup-node action versions used in app testing workflow.
.github/workflows/release.yaml	Bumps release-please and checkout action versions in release workflow.
.github/workflows/release-pr.yaml	Bumps checkout and Docker action versions used in release PR workflow.
.github/workflows/project-pr-automation.yaml	Bumps add-to-project and checkout action versions for PR project automation.
.github/workflows/project-issue-automation.yaml	Bumps add-to-project action version for issue project automation.
.github/workflows/pre-commit-update.yaml	Bumps checkout action version in the pre-commit autoupdate workflow.
.github/dependabot.yml	Adds cooldown, labels, and groups to reduce noise and consolidate GitHub Actions updates.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.