diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 1b48b76..f48e1e2 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -3,12 +3,15 @@ name: build
 
 on:
   push:
-    branches-ignore:
-      - 'tmp**'
+    branches:
+      - master
   pull_request:
     branches-ignore:
       - 'tmp**'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: Build package
@@ -23,7 +26,7 @@ jobs:
         node-version: 24
 
     - name: Install dependencies
-      run: yarn install
+      run: yarn install --frozen-lockfile
 
     - name: Build package
       run: yarn build
@@ -41,7 +44,7 @@ jobs:
         node-version: 24
 
     - name: Install dependencies
-      run: yarn install
+      run: yarn install --frozen-lockfile
 
     - name: Run tests
       run: yarn test
diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml
new file mode 100644
index 0000000..b9766ab
--- /dev/null
+++ b/.github/workflows/pr-title.yml
@@ -0,0 +1,34 @@
+name: pr-title
+
+on:
+  pull_request_target:
+    types: [opened, edited, reopened, synchronize]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  semantic-title:
+    name: Validate PR title
+    runs-on: ubuntu-latest
+    steps:
+    - name: Check PR title follows Conventional Commits
+      uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        types: |
+          feat
+          fix
+          perf
+          refactor
+          docs
+          test
+          build
+          ci
+          chore
+          revert
+        requireScope: false
+        subjectPattern: ^(?![A-Z]).+$
+        subjectPatternError: |
+          The subject "{subject}" of PR title "{title}" must start with a lower-case letter.