T8782: add PR title + commit message format rules

Adds two `pull_request_rules` that flag PRs whose title or commit message
headlines do not match the required T-ID format:

  ^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.*

Examples that pass:
  - `T99999: make IPsec secure`
  - `dhcpv6: T8849: Add time-zone support for Kea DHCPv6`

Failing PRs get one of two labels:
  - `invalid-title` — PR title does not conform
  - `invalid-commit-title` — at least one commit's first line does not
    conform

This replaces the reusable workflow at
vyos/.github/.github/workflows/check-pr-message.yml and the per-repo
caller workflows that invoke it. Coverage is dormant in any repo until
it adopts `extends: mergify` in its own `.mergify.yml`; until then the
existing GHA continues to run unchanged.

Implementation notes:

- Mergify exposes only `commits[*].commit_message` (full message, not
  headline-only), but default Python `re` flags make `^` = start-of-
  string and `.*` non-newline-matching, so `^<pattern>` effectively
  checks the first line — equivalent to the GHA's `messageHeadline`.
- Because `commits[*]` returns true on ANY-match and Mergify has no
  `!~=` operator, the commit-message rule uses a negative-lookahead
  regex that fires when at least one commit's first line does NOT
  conform.
- Regex verified locally against representative valid samples (5 pass)
  and invalid samples (6 caught, including `Bump foo from 1.2.3 to
  1.2.4` and `Merge pull request #...` — same behavior as the existing
  GHA, no regression).

Migration sequence (out of scope for this commit):
  1. This PR lands; rules dormant.
  2. Per-repo PRs add `extends: mergify` (vyos-documentation PR #2005
     is the first canary).
  3. After parallel coverage confirms equivalence, retire per-repo
     check-pr-message.yml callers and the central reusable workflow
     in vyos/.github.

🤖 Generated by [robots](https://vyos.io)

1 files changed, 49 insertions, 0 deletions

diff --git a/.mergify.yml b/.mergify.yml
index 029faa6..c92ed52 100644
--- a/.mergify.yml
+++ b/.mergify.yml
@@ -45,6 +45,55 @@ pull_request_rules:
         toggle:
           - conflicts
 
+  # ------------------------------------------------------------------
+  # PR-message format rules — replaces vyos/.github:check-pr-message.yml
+  #
+  # Title and every commit's first line must follow:
+  #   [optional `scope: ` prefix] T<digits>: <text>
+  # Examples:
+  #   T99999: make IPsec secure
+  #   dhcpv6: T8849: Add time-zone support for Kea DHCPv6
+  #
+  # The valid-form pattern:
+  #   ^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.*
+  #
+  # Mergify exposes only `commit_message` (full message, not headline-only),
+  # but the default Python `re` flags make `^` = start-of-string and `.*`
+  # non-newline-matching, so `^<pattern>` effectively checks the first line
+  # — equivalent to the original GHA's `messageHeadline` check.
+  #
+  # Because `commits[*]` returns true if ANY commit matches, and there is no
+  # `!~=` operator, the commit-message rule uses a negative-lookahead regex
+  # that matches when at least one commit's first line does NOT conform.
+  # ------------------------------------------------------------------
+
+  - name: Flag PR title not matching T-ID format
+    description: >
+      PR title must be `T<digits>: <text>`, optionally prefixed with `scope: `.
+      Replaces the title half of vyos/.github:check-pr-message.yml.
+    conditions:
+      - '-closed'
+      - '-merged'
+      - '-title~=^(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+.*'
+    actions:
+      label:
+        toggle:
+          - invalid-title
+
+  - name: Flag commit message not matching T-ID format
+    description: >
+      Each commit's first line must match `T<digits>: <text>`, optionally
+      prefixed with `scope: `. Replaces the commit-message half of
+      vyos/.github:check-pr-message.yml.
+    conditions:
+      - '-closed'
+      - '-merged'
+      - 'commits[*].commit_message~=^(?!(([a-zA-Z0-9\-_.]+:\s)?)T\d+:\s+[^\s]+).*'
+    actions:
+      label:
+        toggle:
+          - invalid-commit-title
+
 commands_restrictions:
   backport: &allowed
     conditions: