ci: dependabot title exemption, dependency floors, masked account id (#110)

Phase C of the OSS-ready program.

- **PR-title gate**: Conventional-Commits pattern still enforced for
all; the 72-char ceiling now exempts `dependabot[bot]` (titles are
machine-generated and unshortenable — #76/#78 fail today solely on
length; commitlint's own ceiling is 100).
- **Dependency floors**: `dompurify` → 3.4.12 (closes alert #5);
`body-parser` → 2.3.0 (resolved 2.2.2 was in-range via express + MCP-SDK
paths, closes alert #4).
- **`CLOUDFLARE_ACCOUNT_ID`** now read from secrets (masked in public
run logs; secret created beforehand; the variable is deleted after the
next validated dispatch — historical logs remain unredacted regardless).
- `build-snapshot` environment casing normalized to `Production`;
sandbox Dockerfile comment ties alerts #9/#8 to the existing overlay
mitigation.

## Verification notes

- [x] `pnpm lint` / `pnpm typecheck` / `pnpm turbo build --force` /
`pnpm deadcode` / `pnpm architecture:check` / `pnpm turbo skills:build`
— independent clean-install rerun
- Lockfile diff limited to the two override resolutions; `pnpm why
body-parser` single-resolves 2.3.0.
- Post-merge: rebase #76/#78 (title gate), re-run #96 (expired
quarantine), merge #81 after diff re-check; dispatch deploy to validate
the secret-backed account id; then delete the variable.

Author: iamjr15

.github/workflows/build-snapshot.yml

@@ -24,7 +24,7 @@ jobs:
   build-snapshot:
     runs-on: ubuntu-24.04
     timeout-minutes: 60
-    environment: production
+    environment: Production
     steps:
       - name: Authorize snapshot publication
         env:

.github/workflows/deploy-cloudflare.yml

@@ -70,5 +70,5 @@ jobs:
               --var "CHEATCODE_RELEASE_SHA:$GITHUB_SHA"
           done
         env:
-          CLOUDFLARE_ACCOUNT_ID: ${{ vars.CLOUDFLARE_ACCOUNT_ID }}
+          CLOUDFLARE_ACCOUNT_ID: ${{ secrets.CLOUDFLARE_ACCOUNT_ID }}
           CLOUDFLARE_API_TOKEN: ${{ secrets.CLOUDFLARE_API_TOKEN }}

.github/workflows/static-checks.yml

@@ -38,21 +38,24 @@ jobs:
       - name: Validate pull request title
         if: github.event_name == 'pull_request'
         env:
+          PR_AUTHOR: ${{ github.event.pull_request.user.login }}
           PR_TITLE: ${{ github.event.pull_request.title }}
         run: |
           python3 - <<'PY'
           import os
           import re
 
+          author = os.environ["PR_AUTHOR"]
           title = os.environ["PR_TITLE"]
           pattern = re.compile(
               r"(?:build|chore|ci|docs|feat|fix|perf|refactor|revert|style|test)"
               r"(?:\([a-z0-9][a-z0-9._/-]*\))?!?: \S.*"
           )
-          if len(title) > 72 or pattern.fullmatch(title) is None:
-              raise SystemExit(
-                  "Pull request titles must use Conventional Commits and be at most 72 characters."
-              )
+          if pattern.fullmatch(title) is None:
+              raise SystemExit("Pull request titles must use Conventional Commits.")
+          # Dependabot titles are machine-generated from group/directory names, grow past 72 chars, and are not configurable; commitlint's own ceiling is 100.
+          if len(title) > 72 and author != "dependabot[bot]":
+              raise SystemExit("Pull request titles must be at most 72 characters.")
           PY
 
       - name: Classify changed files

infra/containers/sandbox/Dockerfile

@@ -35,6 +35,7 @@ COPY package-manager/package.json package-manager/package-lock.json /opt/cheatco
 COPY doc-runtime/package.json doc-runtime/package-lock.json /opt/cheatcode-doc-runtime/
 # npm, pnpm, and code-server ship their own dependency trees, so ordinary
 # top-level overrides cannot replace vulnerable packages inside those bundles.
+# Dependabot alerts #9 (brace-expansion) and #8 (tar) are lockfile-metadata findings mitigated by this overlay because npm has not re-bundled the fixed versions.
 COPY runtime-security-overrides/package.json runtime-security-overrides/package-lock.json /opt/cheatcode-runtime-security-overrides/
 COPY skill-runtime/package.json skill-runtime/package-lock.json skill-runtime/tsconfig.json /opt/cheatcode-skill-runtime/
 COPY skill-runtime/bin/ /opt/cheatcode-skill-runtime/bin/

pnpm-lock.yaml

@@ -49,7 +49,8 @@ overrides:
   '@tootallnate/once@>=2.0.0 <2.0.1': 2.0.1
   '@vercel/node@5.8.25>undici': 6.27.0
   'ajv@>=8.0.0 <8.18.0': 8.20.0
-  'dompurify@<=3.4.10': 3.4.11
+  'body-parser@>=2.0.0 <2.3.0': 2.3.0
+  'dompurify@<=3.4.11': 3.4.12
   'fast-uri@<3.1.4': 3.1.4
   'js-yaml@<3.15.0': 3.15.0
   'js-yaml@>=4.0.0 <4.3.0': 4.3.0