[showxu]

Pull-request policy now matches the organization standard: it checks the title, added content and added or modified paths. Members squash-merge with the PR title as the subject and an empty body, so pull-request commits never reach the default branch.

What changes

• Pull requests no longer check individual commits. Merge commits that update a pull request pass, and so do external contributors' commits, whatever their subject, trailers, committer or signature.
• Each new default-branch commit is still checked for:
  • GitHub verification;
  • a GitHub or owner committer;
  • a Conventional Commit subject;
  • no attribution trailer.
    The original author is not restricted.
• Manual dispatch checks only the selected commit.
• Breaking: the dependabot-exception input is removed. It existed only for pull-request commit checks, and default-branch squash commits carry no trailers. This repository was the only caller passing it.
• README states the squash-only caller requirement and what each event checks. CHANGELOG records both changes under ## Unreleased. No version is released; members move their pins to the merge commit.

Validation

• python3 -m unittest discover -s tests: 140 tests pass. actionlint passes.
• On the previous script, the new pull-request test fails. It covers a Git default merge commit and an external, unsigned commit carrying trailers, and it asserts that an added-line finding is still reported.
• The default-branch push test reports a foreign committer and an unverified commit, and passes commits authored by a contributor.
• Independent reviews: one for correctness, one for design and docs. Their findings are addressed in the second commit. A pre-existing gap stays out of scope: when the previous tip of a force-pushed default branch is missing, policy checks only the new head.
• This repository's own policy check runs the candidate.