feat: add conventional commit lint and semver suggestion to PR checks

.github/workflows/validate.yml

@@ -44,7 +44,87 @@ jobs:
             (echo "ERROR: .gitignore does not exclude .secrets" && exit 1)
           echo ".gitignore protects .secrets ✓"
 
-  # ── Job 2: Formula audit (requires macOS + Homebrew) ──────────────────────
+  # ── Job 2: Conventional commits + semver suggestion (PRs only) ────────────
+  commit-lint:
+    name: Commit Lint
+    runs-on: ubuntu-latest
+    if: github.event_name == 'pull_request'
+    steps:
+      - uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Check conventional commit format
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          PATTERN='^(feat|fix|docs|chore|refactor|test|style|perf|ci|build|revert)(\([^)]+\))?(!)?: .+'
+          FAIL=0
+
+          while IFS= read -r msg; do
+            [[ -z "$msg" ]] && continue
+            if echo "$msg" | grep -Eq "$PATTERN"; then
+              echo "  ✓ $msg"
+            else
+              echo "  ✗ Non-conventional: $msg"
+              FAIL=1
+            fi
+          done < <(git log --no-merges --format='%s' "${BASE_SHA}..${HEAD_SHA}")
+
+          if [[ $FAIL -eq 1 ]]; then
+            echo ""
+            echo "Commit messages must follow: <type>[scope][!]: <description>"
+            echo "Types: feat fix docs chore refactor test style perf ci build revert"
+            exit 1
+          fi
+          echo "All commit messages are conventional ✓"
+
+      - name: Suggest semver bump
+        env:
+          BASE_SHA: ${{ github.event.pull_request.base.sha }}
+          HEAD_SHA: ${{ github.sha }}
+        run: |
+          BUMP="patch"
+          BREAKING=""
+          FEATURES=""
+
+          while IFS= read -r msg; do
+            [[ -z "$msg" ]] && continue
+            if echo "$msg" | grep -Eq '^(feat|fix|docs|chore|refactor|test|style|perf|ci|build|revert)(\([^)]+\))?!: '; then
+              BREAKING="$BREAKING\n  - $msg"
+              BUMP="major"
+            elif echo "$msg" | grep -Eq '^feat(\([^)]+\))?: '; then
+              FEATURES="$FEATURES\n  - $msg"
+              [[ "$BUMP" != "major" ]] && BUMP="minor"
+            fi
+          done < <(git log --no-merges --format='%s' "${BASE_SHA}..${HEAD_SHA}")
+
+          {
+            case $BUMP in
+              major)
+                echo "## ⚠️ Suggested bump: \`major\`"
+                echo ""
+                echo "This PR contains **breaking changes** — increment the major version."
+                printf "%b\n" "$BREAKING"
+                ;;
+              minor)
+                echo "## ✨ Suggested bump: \`minor\`"
+                echo ""
+                echo "This PR adds **new functionality** — increment the minor version."
+                printf "%b\n" "$FEATURES"
+                ;;
+              patch)
+                echo "## 🔧 Suggested bump: \`patch\`"
+                echo ""
+                echo "This PR is a **fix or maintenance** change — increment the patch version."
+                ;;
+            esac
+            echo ""
+            echo "Tag the next release with: \`./scripts/bump-version.sh $BUMP\`"
+          } | tee -a "$GITHUB_STEP_SUMMARY"
+
+  # ── Job 3: Formula audit (requires macOS + Homebrew) ──────────────────────
   formula-audit:
     name: Formula Audit
     runs-on: macos-latest