build: add workflow to validate local dev setup via commit metadata

PR-URL: #5696
Closes: stdlib-js/metr-issue-tracker#46
Reviewed-by: Athan Reines <kgryte@gmail.com>

Author: Planeshifter

.github/workflows/check_commit_metadata.yml

@@ -0,0 +1,78 @@
+#/
+# @license Apache-2.0
+#
+# Copyright (c) 2025 The Stdlib Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#/
+
+# Workflow name:
+name: check_commit_metadata
+
+# Workflow triggers:
+on:
+  # Trigger on pull request events:
+  pull_request_target:
+    types:
+      - opened
+
+# Global permissions:
+permissions:
+  # Allow read-only access to the repository contents:
+  contents: read
+
+# Workflow jobs:
+jobs:
+
+  # Define a job for checking the commit metadata for whether local development is properly setup...
+  check_commit_metadata:
+
+    # Define a display name:
+    name: 'Check Commit Metadata'
+
+    # Define the type of virtual host machine:
+    runs-on: ubuntu-latest
+
+    # Skip this job for PRs opened by automated bot accounts:
+    if: github.event.pull_request.user.login != 'stdlib-bot' && github.event.pull_request.user.login != 'dependabot[bot]'
+
+    # Define the sequence of job steps...
+    steps:
+      # Checkout the repository:
+      - name: 'Checkout repository'
+        # Pin action to full length commit SHA
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          # Specify whether to remove untracked files before checking out the repository:
+          clean: true
+
+          # Limit clone depth to the most recent commit:
+          fetch-depth: 1
+
+          # Specify whether to download Git-LFS files:
+          lfs: false
+        timeout-minutes: 10
+
+      # Extract commit metadata from commit messages as JSON:
+      - name: 'Extract commit metadata'
+        id: extract-metadata
+        uses: stdlib-js/metadata-action@v2
+
+      # Check commit metadata:
+      - name: 'Check commit metadata'
+        env:
+          PR_NUMBER: ${{ github.event.pull_request.number }}
+          COMMIT_METADATA: ${{ steps.extract-metadata.outputs.metadata }}
+          GITHUB_TOKEN: ${{ secrets.STDLIB_BOT_PAT_REPO_WRITE }}
+        run: |
+          . "$GITHUB_WORKSPACE/.github/workflows/scripts/check_commit_metadata" $PR_NUMBER $COMMIT_METADATA