ci: keep refresh-visual-baselines commit body under commitlint's 100-char limit

[bpamiri]

Summary

• The auto-generated commit body in .github/workflows/refresh-visual-baselines.yml inlined the workflow path and branch name on a single line, producing lines >100 chars for normal-length branch names and failing commitlint's body-max-line-length rule on every auto-baseline-refresh.
• Split on branch <BRANCH>. onto its own line so the commit body now stays under 100 chars regardless of branch-name length.
• Concrete instances observed on fix(middleware): short-circuit OPTIONS preflight in dispatch when CORS middleware is registered #2728: commits 0e956bac and 3123a386 each produced a 121-char body line; both required manual amends. Repro is reliable on any branch with a name longer than ~37 chars.

Before / after (using branch fix/bot-2703-wheels-middleware-cors-cannot-short-circuit-option)

Before: .github/workflows/refresh-visual-baselines.yml on branch fix/bot-2703-... → 121 chars (fails commitlint).

After: workflow path on one line + on branch <BRANCH>. on the next → max 74 chars in the entire body. Branch names can grow to ~89 chars before tripping the limit, far beyond any realistic branch name in this repo.

Test plan

• Simulated the heredoc generation locally against the 63-char branch from fix(middleware): short-circuit OPTIONS preflight in dispatch when CORS middleware is registered #2728; max line is 74 chars.
• Ran the resulting commit message through this repo's local commitlint (exit 0).
• Verify the next auto-fired baseline refresh (the workflow is only manually-triggered, so this will be confirmed when someone next runs it from the Actions UI).

🤖 Generated with Claude Code

[wheels-bot]

Wheels Bot — Reviewer A

TL;DR: This is a targeted one-line CI fix that splits a too-long printf argument into two calls so auto-generated commit bodies stay under @commitlint/config-conventional's body-max-line-length: [2, 'always', 100] rule. The problem is real (documented with reproducible commit SHAs on #2728), the fix is correct and minimal, and the commit conforms to the repo's conventions. Verdict: approve.

Correctness

The fix is correct.

Before, a single printf call produced a body line exceeding 100 chars when BRANCH was long:

printf '%s\n\n' ".github/workflows/refresh-visual-baselines.yml on branch $BRANCH."

With a 63-char branch name (e.g. fix/bot-2703-wheels-middleware-cors-cannot-short-circuit-option) this produces a 121-char body line — above the 100-char limit enforced by @commitlint/config-conventional v19. That rule is not overridden in the project's own commitlint.config.js, which only customises subject-empty, type-empty, header-max-length, and subject-case.

After the fix, the same content is split across two printf calls:

printf '%s\n' ".github/workflows/refresh-visual-baselines.yml"
printf '%s\n\n' "on branch $BRANCH."

The longest possible body line is now on branch <BRANCH>. -- 10 + len(BRANCH) + 1 chars. All other hard-coded body lines in the commit template are at most 73 chars. Branch names would have to reach about 89 chars before the limit fires again, far beyond any realistic name in this repo.

The existing security invariant -- routing github.ref_name through env: rather than direct shell interpolation -- is preserved unchanged.

Commits

ci: keep refresh-visual-baselines commit body under commitlint's 100-char limit is 79 chars, uses type ci from the allowlist, omits scope (acceptable), is not ALL-CAPS, and the header is well under 100 chars. Conforms to commitlint.config.js.

[wheels-bot]

Wheels Bot — Reviewer B (round 1)

A's review checks out. The fix is minimal and correct — two printf calls instead of one, verified against the diff. A's 121-char calculation and 89-char new limit are both accurate. The security invariant (no new ${{ }} interpolation) is confirmed. Commit message conforms to commitlint.config.js. No sycophancy, no false positives, no missed issues.

Sycophancy

None detected. A cited specific evidence (reproducible commit SHAs, char-count math, reference to the exact commitlint rule) before approving.

False positives

None detected. Every claim A made was verified against the diff.

Missed issues

None detected. This is a pure CI workflow edit with no CFML, no cross-engine concerns, no security surface, and no .ai/wheels/ updates needed.

Verdict alignment

A's approve verdict is consistent with the findings.

Convergence

Aligned. The fix is correct, the commit conforms, and there is nothing to request changes on. Joint recommendation: approve and merge.