ci: add release-version validation and PR-title enforcement

.github/workflows/ci.yml

@@ -44,6 +44,17 @@ jobs:
       - name: Validate against the live registry schema
         run: npx --yes @tabularium/cli validate .tabularium --registry https://registry.tabularis.dev --kind driver
 
+  pr-title:
+    name: PR title (Conventional Commits)
+    if: github.event_name == 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    steps:
+      - uses: amannn/action-semantic-pull-request@v6
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
   markdownlint:
     name: Markdown lint
     runs-on: ubuntu-latest

.github/workflows/release.yml

@@ -6,8 +6,25 @@ on:
       - "v*"
 
 jobs:
+  validate:
+    name: Validate release version
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - name: Check tag matches manifest version
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          TABULARIUM_VERSION=$(jq -r .version .tabularium)
+
+          if [ "$TAG_VERSION" != "$TABULARIUM_VERSION" ]; then
+            echo "::error::Tag version ($TAG_VERSION) does not match .tabularium version ($TABULARIUM_VERSION)"
+            exit 1
+          fi
+
   build:
     name: ${{ matrix.platform-label }}
+    needs: validate
     runs-on: ${{ matrix.runner }}
     strategy:
       fail-fast: false

CHANGELOG.md

@@ -29,6 +29,19 @@
 
 ### Added
 
+- Two more CI checks:
+  - `release.yml`: a `validate` job gates the build matrix on the pushed
+    tag matching `.tabularium`'s `version` field (stripped of the `v`
+    prefix) — ported from the `tabularis-elasticsearch-plugin` sibling's
+    pattern. This isn't just convention: the registry's own manifest
+    schema documents this as a hard rule ("the registry rejects ingests
+    whose tag and manifest version disagree"), so this catches the
+    mismatch at tag-push time instead of at registry-submission time.
+  - `ci.yml`: a `pr-title` job enforces Conventional Commits PR titles via
+    `amannn/action-semantic-pull-request`, triggered on plain
+    `pull_request` (not `pull_request_target`) since this repo doesn't
+    need fork-PR support and the plain event avoids the elevated-
+    permission surface entirely.
 - CI hardening — deliberately set a higher bar than the sibling plugin
   repos and the org's own documented requirements (no sibling runs
   `cargo audit`; only 2 of 11 Rust siblings gate on clippy/fmt at all):