fix(ci): allow capitalized Dependabot PR titlesUpdate pr-title-check.yml

[vijay s m (vijay03-creator)]

Related Issue

Fixes #3559

Problem & Solution

Dependabot PRs can use capitalized subjects such as Bump and Update, which currently fail the Validate PR title check because the validator requires the subject to start with a lowercase letter.

This change allows capitalized subjects for Dependabot PRs while keeping the existing lowercase subject requirement for other contributors.

Impact on Your Work

This removes the need to manually retitle Dependabot PRs before they can pass the PR title validation check.

Timeline

None

Alternatives Considered

The issue suggested either relaxing the validator for Dependabot or automatically retitling Dependabot PRs. I chose to adjust the validator so valid Dependabot titles are accepted without modifying the PR title.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update
• Maintenance (dependency updates, CI/CD, refactoring)
• Security fix

Package(s) Affected

• action (GitHub Action)

Testing

Unit Testing

No unit tests were added because this change modifies GitHub Actions workflow configuration.

Manual Testing

Verified the workflow change and confirmed that the existing lowercase subject rule remains in place for non-Dependabot PRs while Dependabot PRs can use capitalized subjects.

Checklist

• I have linked a related issue above
• I have added tests that prove my fix/feature works
• All new and existing tests pass
• I have updated documentation as needed
• I have signed the Microsoft CLA

Attribution & Prior Art

No external code was copied or derived for this change.

AI Assistance

AI assistance was used to help identify the relevant workflow and draft the configuration change. I reviewed the resulting change before submission.

IP, Patents, and Licensing

This contribution does not knowingly implement patent-pending or patent-encumbered techniques and does not require an NDA or additional licensing agreement.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

Welcome to the Agent Governance Toolkit! Thanks for your first pull request.
Please ensure tests pass, code follows style (ruff check), and you have signed the CLA.
See our Contributing Guide.

[github-actions]

PR Review Summary

Check	Status	Details
🔍 Code Review	⚠️ Missing	No current-run comment
🛡️ Security Scan	⚠️ Missing	No current-run comment
🔄 Breaking Changes	⚠️ Missing	No current-run comment
📝 Docs Sync	⚠️ Missing	No current-run comment
🧪 Test Coverage	⚠️ Missing	No current-run comment

Verdict: ⚠️ AI review incomplete; ready for human review

AI review comments are untrusted advisory output. The summary reports workflow-generated completion status only, not model-authored pass/fail claims.

[vijay s m (vijay03-creator)]

Hi! This PR fixes #3559 by allowing capitalized Dependabot PR titles while keeping the existing lowercase-title requirement for other contributors.

The PR Title Check is passing, and all available checks have completed successfully. Could a code owner please review when convenient? Thank you!

[Sirbu Stefan Andrei (st3fansrb)]

Heads up on the testing side: I don't think the green Validate PR title check
on this PR proves the change works.

This workflow runs on pull_request_target, so the workflow file is loaded from
main, not from the PR. The check that passed here was still the old
^(?![A-Z]).+$. Your version only takes effect once this is merged, and the
behavior change only shows up on the next Dependabot PR.

You can still demonstrate it in a fork: put the change on your fork's default
branch and open a PR there with a capitalized title. Temporarily swapping
dependabot[bot] for your own login exercises the Dependabot branch of the
expression; leaving it as-is covers the other one. Linking that from the
description would give a reviewer something concrete.

The login does match, by the way: the recent Dependabot PRs here (#3630, #1292)
are both dependabot[bot].

[Imran Siddique (imran-siddique)]

Thanks for picking this up, and welcome. The approach is right, and it is the better of the two ways to fix #3559: making subjectPattern conditional relaxes only the case rule, so a Dependabot PR with a malformed type prefix is still caught. I had opened #3720 doing the same thing with ignoreLabels, which skips the whole check including the type list. I have closed mine in favour of this.

Sirbu Stefan Andrei (@st3fansrb) is right about the testing, and it is worth acting on. pull_request_target loads the workflow file from the base branch, so the green Validate PR title on this PR ran the old ^(?![A-Z]).+$, not your version. That check passing says nothing about the change. Their fork suggestion is the cheapest way to get real evidence: put the change on your fork's default branch, open a PR there with a capitalized title, and link the run here. Swapping dependabot[bot] for your own login temporarily exercises the relaxed branch, leaving it exercises the strict one.

Two things blocking the merge, both mechanical.

1. Developer Certificate of Origin is red because the commit has no sign-off. git commit --amend -s then force-push will clear it.
2. The PR title is fix(ci): allow capitalized Dependabot PR titlesUpdate pr-title-check.yml, which looks like two strings joined by accident. Worth fixing on a PR about title hygiene.

One non-blocking observation, recorded rather than requested. The actor test does not match a Dependabot PR that a human recreated: the actor becomes the human while the title stays capitalized. #3559 describes recreated batches specifically, so it may be worth widening later to github.event.pull_request.user.login == 'dependabot[bot]' || contains(github.event.pull_request.labels.*.name, 'dependencies'). I would not hold this PR for it.

Not approving only because I do not have that bit on this repo. Once the sign-off and title are sorted this looks landable to me.