ci: make workflows public-repo safe & unblock Dependabot

.github/workflows/deploy-worker.yml

@@ -1,13 +1,8 @@
 name: Deploy — Smart-Sub Worker
 
 on:
-  push:
-    branches: [main]
-    paths:
-      - "tools/smart-sub/src/**"
-      - "tools/smart-sub/wrangler.toml"
-      - "tools/backup-sub/**"
-      - "config/**"
+  # Auto-deploy on push is intentionally disabled for the public repo — deploying
+  # live infrastructure is a manual, credentialed action. Trigger by hand instead.
   workflow_call:
   workflow_dispatch:
     inputs:

.github/workflows/health-check.yml

@@ -1,8 +1,9 @@
 name: VPN Health Check
 
 on:
-  schedule:
-    - cron: '*/30 * * * *'  # Every 30 minutes
+  # Scheduled monitoring is disabled on the public repo: run logs would expose
+  # live endpoints, and public cron auto-disables after 60 days. Run by hand,
+  # or move monitoring to a private repo / external scheduler.
   workflow_dispatch: {}       # Manual trigger
 
 jobs:

.github/workflows/release.yml

@@ -20,4 +20,5 @@ jobs:
           release-type: node
           config-file: release-please-config.json
           manifest-file: .release-please-manifest.json
-          token: ${{ secrets.RELEASE_TOKEN }}
+          # Fall back to the built-in token when no PAT is configured.
+          token: ${{ secrets.RELEASE_TOKEN || secrets.GITHUB_TOKEN }}

.github/workflows/ripe-atlas-check.yml

@@ -1,8 +1,8 @@
 name: RIPE Atlas Iran Monitor
 
 on:
-  schedule:
-    - cron: '0 */6 * * *'  # Every 6 hours
+  # Scheduled monitoring is disabled on the public repo (run logs would expose
+  # measurement targets). Trigger manually, or run it from a private repo.
   workflow_dispatch:
     inputs:
       measurement_ids:

commitlint.config.js

@@ -21,5 +21,7 @@ export default {
       ],
     ],
     "subject-case": [0], // Allow any case in subject
+    "body-max-line-length": [0], // Allow long lines (URLs, Dependabot bodies)
+    "footer-max-line-length": [0],
   },
 };