fix: authenticate the module fetch for the private commitlint repo

[SafeEval]

Removes the blocker I flagged in #2: the action installs the linter with go install, which fetches over HTTPS with no credentials, so while DivergentCodes/commitlint is private it dies with terminal prompts disabled. The action couldn't run at all, and the self-test was gated off for exactly that reason.

Credit where it's due

This approach comes from agent/fix-action-yaml, a branch already on this repo (authored Jul 27, predating my work). I found it while cleaning up and it had solved this problem before I did. I've ported its insteadOf idea here.

I did not merge that branch wholesale: it fixes the YAML by collapsing the Python to one line but keeps the API-based commit fetching, so it retains the four defects #2 removed — per_page=250 silently capped at 100, unreachable || status=1 in warn mode, the ALLOW_REVERT_PREFIX comment describing merge commits, and an unpinned actions/setup-go@v5. This PR takes its good idea onto the cleaned-up base. agent/fix-action-yaml can be deleted once this merges.

What it does

GOPRIVATE: github.com/DivergentCodes/*
git config --global \
  url."https://x-access-token:${GH_TOKEN}@github.com/DivergentCodes/".insteadOf \
  "https://github.com/DivergentCodes/"

Scoped deliberately:

• Only github.com/DivergentCodes/ URLs are rewritten, so the token is never offered to another host or org.
• GOPRIVATE bypasses the public proxy and checksum database, which cannot see a private module and would fail the fetch rather than fall through.
• The token goes through the environment, not argv, and Actions masks it in logs.
• A trap unsets the global git config on exit, so the credential doesn't linger for later steps in the job.

All of it becomes a no-op once commitlint is public — the rewrite still matches, but the fetch would have succeeded anyway.

Self-test re-enabled

#2 gated it on a COMMITLINT_PUBLIC variable. That's no longer the right condition, since auth now works regardless. The remaining constraint is subtler: the default github.token is scoped to this repository and cannot read a different private one, so a cross-repo token is needed while commitlint stays private.

The job now probes reachability and runs when either condition holds — module is public, or COMMITLINT_READ_TOKEN is present — and skips with a ::notice:: otherwise. Verified the probe returns false for commitlint today and true for a known-public module, so it isn't vacuously passing.

To see the self-test actually run

Set a COMMITLINT_READ_TOKEN secret with read access to DivergentCodes/commitlint. Otherwise it skips until that repo is public — which is fine, and no longer blocks the action itself from working.

Verification

• action.yml and the workflow parse; actionlint clean
• README input table matches action.yml exactly (no undocumented or phantom inputs)
• Reachability probe tested in both directions

🤖 Generated with Claude Code

https://claude.ai/code/session_01VSrrciEDBTuFNMtKocScML