@cldmv/gh-broker 0.0.0-stage → 0.7.0

package/.github/workflows/cla.yml

@@ -0,0 +1,66 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/cla.yml
+#	@Date: 2026-07-19T00:00:00-07:00 (1784444400)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/cla.yml
+#
+# Per-CLA-version signing with per-repo override support. Each commit author
+# must either:
+#   - Be in the org (silent pass via /orgs/CLDMV/members lookup)
+#   - Be in the exempt-bots list
+#   - Already have a signature record at the active (scope, version) in the
+#     central ledger repo (default: CLDMV/.cla-signatures)
+#   - Reply on this PR with the exact required text
+#
+# Default vs. override scope:
+#   - DEFAULT (this repo has NO root-level CLA.md): the bot uses the org-wide
+#     CLA at cla-versions/v<X.Y>.md in the ledger. Signing once covers every
+#     CLDMV repo that uses the default until the major.minor is bumped.
+#   - OVERRIDE (this repo HAS a root-level CLA.md): the bot enforces the
+#     consumer-repo text and reads the version from its header. Signatures
+#     live under signatures/<platform>/overrides/<owner>/<repo>/v<X.Y>/ and
+#     are scoped to this repo only.
+#
+# Required setup:
+#   - Bot App must have `Organization permissions → Members: read` for the
+#     org-member exemption.
+#   - Bot App must have `Repository contents: write` on the ledger repo.
+#   - Optional `CLDMV_CLA_BOT_APP_CLIENT_ID` / `CLDMV_CLA_BOT_APP_PRIVATE_KEY`
+#     org secrets override the general bot identity for CLA actions only.
+name: 📜 CLA
+
+on:
+    pull_request_target:
+        types: [opened, synchronize, reopened, ready_for_review]
+    issue_comment:
+        types: [created]
+
+permissions:
+    contents: read
+
+jobs:
+    cla:
+        permissions:
+            contents: read
+            pull-requests: write
+            statuses: write
+            issues: write
+        uses: CLDMV/.github/.github/workflows/reusable-cla.yml@v4
+        with:
+            cla_version: "1.0"
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+            CLA_BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_CLA_BOT_APP_CLIENT_ID }}
+            CLA_BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_CLA_BOT_APP_PRIVATE_KEY }}
+            TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }}
+            TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}

package/.github/workflows/codeql.yml

@@ -0,0 +1,87 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/codeql.yml
+#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/codeql.yml
+#
+# PRIVATE REPOS are skipped by DEFAULT: the bootstrap's `variables` phase
+# sets CLDMV_SKIP_CODE_SCANNING (this workflow then uploads an empty 0-alert
+# SARIF instead of analyzing) on every private repo not opted in, since Code
+# Security bills per active committer there. To actually scan a private
+# repo: pay for GitHub Code Security and add the repo to the `scan` list in
+# data/code-scanning-skips.json in CLDMV/.github. Public repos scan by
+# default (free); a public repo with nothing to analyze goes in that file's
+# `skip` section. Consumers outside CLDMV can pass `skip_code_scanning:
+# true` below instead. Do NOT just delete this file on a repo whose ruleset
+# requires code_scanning — the gate then waits forever.
+#
+# REQUIRED REPO SETTING — CodeQL must be in "Advanced" mode for this workflow
+# to upload SARIF. If the repo has CodeQL "Default setup" enabled (the
+# GitHub-managed alternative), upload runs fail with:
+#
+#   "Code Scanning could not process the submitted SARIF file: CodeQL
+#    analyses from advanced configurations cannot be processed when the
+#    default setup is enabled"
+#
+# The org-bootstrap-repo action automatically disables default setup
+# (overwrite-with-warn) on every fanout run, so a freshly-bootstrapped
+# repo lands in the right state by default. If you want to KEEP default
+# setup (the GitHub-managed config) instead of this workflow, DELETE
+# this codeql.yml file — with the conflict gone, the bootstrap leaves
+# default setup alone on subsequent runs.
+#
+# Manual fix when running outside the bootstrap:
+#   Settings → Code security and analysis → Code scanning → CodeQL
+#   analysis → ⚙️ → Switch to advanced.
+name: 🔍 CodeQL
+
+on:
+    push:
+        branches: [master, main]
+    # Same fork-PR consideration as ci.yml: pull_request fires for forks; SARIF
+    # upload to base-repo Security tab fails with read-only token. Acceptable —
+    # push-to-master analysis after merge catches anything missed. DO NOT use
+    # pull_request_target (runs base-repo workflow with secrets against fork
+    # code; dangerous).
+    pull_request:
+        types: [opened, synchronize, reopened, ready_for_review]
+        # Include the v4 integration branches (`next`, `hotfixes`) so feature
+        # and hotfix PRs trigger CodeQL. Without these, branch protection
+        # rulesets that require the CodeQL check on `next`/`hotfixes` will
+        # sit on "waiting for results" indefinitely. Branches that don't
+        # exist in a given repo simply never trigger the workflow — harmless
+        # for repos that haven't adopted the v4 staging-branch flow.
+        branches: [master, main, next, hotfixes]
+    schedule:
+        - cron: "37 14 * * 1" # weekly Monday 14:37 UTC; GitHub updates queries over time
+
+permissions:
+    contents: read
+
+concurrency:
+    group: codeql-${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/main' }}
+
+jobs:
+    analyze:
+        permissions:
+            security-events: write
+            contents: read
+            actions: read
+        uses: CLDMV/.github/.github/workflows/reusable-codeql.yml@v4
+        with:
+            languages: "javascript-typescript"
+            # Override defaults if needed:
+            # queries: "security-extended,security-and-quality"
+            # paths_ignore: "node_modules/,dist/,coverage/,**/test/**"
+            # config_file: ".github/codeql-config.yml"
+            # build_mode: "autobuild"

package/.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,62 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/dependabot-auto-merge.yml
+#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/dependabot-auto-merge.yml
+#
+# Auto-approves + queues auto-merge for Dependabot patch/minor bumps after
+# CI passes. Major bumps are left for a human.
+#
+# Default in v4: ON. To opt out, delete this file — Dependabot PRs still
+# flow into `next` (via dependabot.yml) but require a manual merge click.
+#
+# How v4 routing works:
+#   - dependabot.yml sets `target-branch: next`, so Dependabot opens PRs
+#     against `next`. This workflow auto-merges those PRs into `next` after
+#     CI; they batch into the next release like every other change.
+#   - For security advisories, hotfix-redirector.yml (release-flow-v4/)
+#     detects GHSA references in the PR body and retargets the PR from
+#     `next` → `hotfixes` *before* this workflow runs, so security updates
+#     auto-merge into the hotfix lane instead of waiting for the next batch.
+#
+# Required setup (one-time per repo):
+#   1. Settings → Pull Requests → "Allow auto-merge" → ON
+#      (enabled automatically by `release-flow-v4/v4-bootstrap.yml`)
+#   2. Branch protection on `next` and `hotfixes` with required CI status
+#      checks — the action refuses to merge into an unprotected branch.
+# Both are validated by the action; the workflow fails loudly if missing.
+name: 🤖 Dependabot Auto-Merge
+
+on:
+    pull_request:
+        types: [opened, reopened, synchronize, ready_for_review]
+
+permissions:
+    contents: read
+
+jobs:
+    automerge:
+        permissions:
+            contents: write
+            pull-requests: write
+        # Pre-filter at workflow level so this doesn't spin up for every PR.
+        if: github.event.pull_request.user.login == 'dependabot[bot]'
+        uses: CLDMV/.github/.github/workflows/reusable-dependabot-auto-merge.yml@v4
+        with:
+            bump_types: "patch,minor"
+            # merge_method defaults to "merge" — Dependabot PRs target next / hotfixes,
+            # whose rulesets are merge-only. Override only if your branches differ.
+            # merge_method: "merge"
+            # also_for_actors: "renovate[bot]"   # extend if you adopt Renovate
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/dependabot-recreate.yml

@@ -0,0 +1,67 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/dependabot-recreate.yml
+#	@Date: 2026-07-31T00:00:00-07:00 (1785481200)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/dependabot-recreate.yml
+#
+# Auto-fires `@dependabot recreate` when a Dependabot PR gets stuck in the
+# "edited by someone other than Dependabot" state. That state breaks
+# `@dependabot rebase` and — under a required-signed-commits ruleset — blocks
+# the PR with an unsigned commit. `recreate` rebuilds it as a fresh, signed
+# Dependabot commit that dependabot-auto-merge.yml then merges. See
+# reusable-dependabot-recreate.yml for the mechanics + the command-actor caveat.
+#
+# Default in v4: ON. Delete this file to opt out entirely; add a `no-recreate`
+# label to a specific PR to exempt just that one (e.g. one you've hand-edited
+# on purpose and don't want overwritten).
+#
+# Triggers:
+#   - issue_comment: catches Dependabot's own "can't rebase, use recreate" reply
+#     (Dependabot only comments back when a rebase FAILS — success is a silent
+#     👍 + force-push).
+#   - pull_request_target: proactive net for a Dependabot PR whose head commit
+#     is unverified. pull_request_target (not pull_request) is required so the
+#     job can read the bot-App secrets — Dependabot-triggered `pull_request`
+#     runs get a read-only token and no secrets. It is SAFE here: Dependabot PRs
+#     are same-repo branches (not forks), and this workflow never checks out or
+#     runs PR code — it only reads the PR and posts a comment via the API.
+name: 🔁 Dependabot Auto-Recreate
+
+on:
+    issue_comment:
+        types: [created]
+    pull_request_target:
+        types: [opened, synchronize, reopened]
+
+permissions:
+    contents: read
+    pull-requests: write
+    issues: write
+
+jobs:
+    recreate:
+        # A) Dependabot replied that it can't rebase (the PR was edited), or
+        # B) a Dependabot PR opened/updated — the reusable then checks whether
+        #    its head commit is actually unverified before doing anything.
+        if: >-
+            (github.event_name == 'issue_comment'
+              && github.event.issue.pull_request
+              && github.event.comment.user.login == 'dependabot[bot]'
+              && contains(github.event.comment.body, 'edited by someone other than Dependabot'))
+            || (github.event_name == 'pull_request_target'
+              && github.event.pull_request.user.login == 'dependabot[bot]')
+        uses: CLDMV/.github/.github/workflows/reusable-dependabot-recreate.yml@v4
+        with:
+            skip_label: "no-recreate"
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/dependency-review.yml

@@ -0,0 +1,46 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/dependency-review.yml
+#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/dependency-review.yml
+#
+# PRIVATE REPOS are skipped by DEFAULT (the dependency-review API needs
+# GitHub Advanced Security there): the bootstrap's `variables` phase sets
+# CLDMV_SKIP_DEPENDENCY_REVIEW on every private repo not opted into the
+# `scan` list in data/code-scanning-skips.json in CLDMV/.github. To run the
+# review on a private repo, pay for Code Security and add it to that list.
+# Consumers outside CLDMV can pass `skip_dependency_review: true` below
+# instead.
+name: 🔒 Dependency Review
+
+on:
+    pull_request:
+        types: [opened, synchronize, reopened, ready_for_review]
+        branches: [master, main]
+
+permissions:
+    contents: read
+    pull-requests: write
+
+jobs:
+    review:
+        uses: CLDMV/.github/.github/workflows/reusable-dependency-review.yml@v4
+        with:
+            fail_on_severity: "moderate"
+            # Per-repo license policy override:
+            # deny_licenses: "AGPL-3.0,LGPL-3.0"   # block copyleft for an Apache-2.0 repo
+        # Bot App credentials. When set, the dependency-review PR comment is
+        # posted by the consumer's bot App instead of github-actions[bot].
+        # Both lines are optional; remove them to fall back to GITHUB_TOKEN.
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/feature-pr.yml

@@ -0,0 +1,75 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/feature-pr.yml
+#	@Date: 2026-08-02T16:55:52-07:00 (1785714952)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/feature-pr.yml
+#
+# v4 ergonomics: auto-opens (and refreshes) a PR from a code-side branch to the
+# right integration branch on every push.
+#
+# Mapping (matches CLDMV/.github docs/conventions/branch-naming.md):
+#   feat/*, feature/*, fix/*, release/*, chore/*, deps/*, refactor/*,
+#   docs/*, ci/*, perf/*, test/*, style/*           → next
+#   hotfix/*                                         → hotfixes
+#
+# Reserved branches NOT auto-PR'd: dependabot/* and copilot/* (they manage their
+# own PRs); badges, gh-pages (bot-only); master/main (the target).
+#
+# Thin caller: all job logic (target detection, changelog body, PR create/
+# refresh) lives in the reusable, pinned at @v4. Bumping the pin carries fixes
+# without editing this file. The `push` trigger and its branch-prefix list stay
+# here (GitHub requires the trigger local, and the list is per-repo config).
+name: 🔀 Feature PR (v4)
+
+on:
+    push:
+        branches:
+            # CUSTOMIZE: prune this list to whichever branch prefixes your
+            # repo uses. Must align with the `case` statement in the reusable.
+            - 'feat/**'
+            - 'feature/**'
+            - 'fix/**'
+            - 'release/**'
+            - 'chore/**'
+            - 'deps/**'
+            - 'refactor/**'
+            - 'docs/**'
+            - 'ci/**'
+            - 'perf/**'
+            - 'test/**'
+            - 'style/**'
+            - 'hotfix/**'
+
+concurrency:
+    group: feature-pr-${{ github.repository }}-${{ github.ref }}
+    cancel-in-progress: false
+
+permissions:
+    contents: read
+
+jobs:
+    open-pr:
+        permissions:
+            contents: read
+            pull-requests: write
+        uses: CLDMV/.github/.github/workflows/workflow-feature-pr.yml@v4
+        secrets:
+            # Map your repo/org secrets to the expected names.
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+            # Optional: only needed if you also use reusable-lint-format.yml /
+            # reusable-coverage-badge.yml (or otherwise sign a commit locally as
+            # this identity). Passed through so this PR's changelog body
+            # recognizes that identity as a bot instead of listing it as a
+            # contributor.
+            BOT_NAME: ${{ secrets.CLDMV_BOT_NAME }}
+            BOT_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}

package/.github/workflows/hotfix-redirector.yml

@@ -0,0 +1,67 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/hotfix-redirector.yml
+#	@Date: 2026-05-22T00:00:00-07:00 (1779433200)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/hotfix-redirector.yml
+#
+# v4 hotfix lane: retarget hotfix/security PRs to the `hotfixes` branch.
+#
+# Two paths trigger a redirect (CLDMV/.github docs/conventions/release-flow-v4.md §5.2, §6.5):
+#   1. Head branch matches `hotfix/*` or `security/*` (human-driven hotfix flow).
+#   2. Author is `dependabot[bot]` AND its base isn't Dependabot's routine
+#      target-branch (default "next") — GitHub always overrides dependabot.yml's
+#      target-branch for security updates, so a base landing on the default
+#      branch instead of "next" is itself the signal. Routine version bumps stay
+#      on "next".
+#
+# Thin caller: all job logic (token, checkout, git identity, redirect action)
+# lives in the reusable, pinned at @v4. Bumping the pin carries new requirements
+# (e.g. the checkout + git identity the cherry-pick path needs) without editing
+# this file.
+name: 🔀 Hotfix PR Redirector (v4)
+
+# SECURITY NOTE: pull_request_target runs in the BASE repo's context with WRITE
+# permissions + secrets. The reusable checks out `hotfixes` (a trusted base-repo
+# branch, NOT the PR head/fork) and only cherry-picks/pushes against it.
+#
+# `opened` only (NOT `edited`): if a maintainer manually re-targets the PR, we
+# must not fight them by redirecting again.
+on:
+    pull_request_target:
+        types: [opened]
+
+concurrency:
+    group: hotfix-redirector-${{ github.event.pull_request.number }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+    redirect:
+        permissions:
+            contents: write
+            pull-requests: write
+        uses: CLDMV/.github/.github/workflows/workflow-hotfix-redirector.yml@v4
+        secrets:
+            # Map your repo/org secrets to the expected names.
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+            # GPG signing identity — REQUIRED if this repo redirects Dependabot
+            # SECURITY PRs: that path cherry-picks a commit onto `hotfixes`, and
+            # an unsigned commit is silently blocked by required-signatures (no
+            # failing check names the cause). The commit is signed and authored as
+            # this real-user bot account (the GPG key's owner), not the App bot.
+            BOT_NAME: ${{ secrets.CLDMV_BOT_NAME }}
+            BOT_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}
+            BOT_GPG_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_GPG_PRIVATE_KEY }}
+            BOT_GPG_PASSPHRASE: ${{ secrets.CLDMV_BOT_GPG_PASSPHRASE }}

package/.github/workflows/hotfixes-release.yml

@@ -0,0 +1,70 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/hotfixes-release.yml
+#	@Date: 2026-05-22T00:00:00-07:00 (1779433200)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/hotfixes-release.yml
+#
+# v4 hotfix lane: maintain the ONE persistent `hotfixes → master` release PR.
+#
+# Mirror of next-release.yml but for the `hotfixes` integration branch
+# (CLDMV/.github docs/conventions/release-flow-v4.md §5.4, §6.2). Fires on every
+# push to `hotfixes` (hotfix/security PR squash-merges land here), and
+# resolves-or-creates the persistent `hotfixes → master` release PR.
+#
+# Thin caller: all job logic (plan / create / refresh) lives in the reusable,
+# pinned at @v4. Bumping the pin carries fixes without editing this file.
+# CUSTOMIZE `package_name` / `build_command` to match your package (same values
+# as your next-release.yml).
+name: 🚑 Hotfixes Release (v4)
+
+on:
+    push:
+        branches: [hotfixes]
+    workflow_dispatch: # manual kick — e.g. to open/refresh the PR for content already on `hotfixes`
+
+concurrency:
+    group: hotfixes-release-${{ github.repository }}
+    cancel-in-progress: false
+
+permissions:
+    contents: read
+
+jobs:
+    release:
+        permissions:
+            contents: write
+            pull-requests: write
+        uses: CLDMV/.github/.github/workflows/workflow-hotfixes-release.yml@v4
+        with:
+            package_name: "@cldmv/gh-broker"
+            build_command: "npm run build:ci"
+        secrets:
+            # Map your repo/org secrets to the expected names.
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+            # Optional: only needed if you also use reusable-lint-format.yml /
+            # reusable-coverage-badge.yml (or otherwise sign a commit locally as
+            # this identity). Passed through so the release-PR changelog
+            # recognizes that identity as a bot instead of listing it as a
+            # contributor — see CLDMV_BOT_NAME/CLDMV_BOT_EMAIL in your other
+            # workflows for the same values.
+            BOT_NAME: ${{ secrets.CLDMV_BOT_NAME }}
+            BOT_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}
+            # Optional release-PR notifier webhooks — each is independently
+            # opt-in: leave one unset and that channel is silently skipped.
+            # Delete the lines you don't use.
+            DISCORD_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PUBLIC_WEBHOOK }}
+            DISCORD_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PRIVATE_WEBHOOK }}
+            SLACK_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PUBLIC_WEBHOOK }}
+            SLACK_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PRIVATE_WEBHOOK }}
+            GENERIC_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PUBLIC_WEBHOOK }}
+            GENERIC_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PRIVATE_WEBHOOK }}

package/.github/workflows/labeler.yml

@@ -0,0 +1,48 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/labeler.yml
+#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/labeler.yml
+#
+# Path-based PR auto-labeler. Uses CLDMV's org-default labeler.default.yml;
+# override per-repo by adding .github/labeler.yml in this repo (same shape).
+#
+# Labels applied additively — never removes labels added by humans or other
+# automation.
+#
+# Batch 5.2 from tmp/plan-future-workflows.md.
+name: 🏷️ PR Labeler
+
+# SECURITY NOTE: This workflow uses pull_request_target so it can apply labels
+# to fork PRs. pull_request_target runs in the BASE repo's context with WRITE
+# permissions and access to secrets. This is SAFE for THIS workflow because:
+#   - We never checkout the PR head ref
+#   - We never run code from the PR (no `run:` step uses PR data)
+#   - We only call REST APIs to read the file list and post labels
+# DO NOT add a checkout step or any step that executes PR-supplied content
+# (build commands, scripts, test runs, etc.) to this workflow.
+on:
+    pull_request_target:
+        types: [opened, synchronize, reopened, ready_for_review]
+
+permissions:
+    contents: read
+    pull-requests: write
+
+jobs:
+    label:
+        uses: CLDMV/.github/.github/workflows/reusable-pr-labeler.yml@v4
+        # Optional. Without these, labels are attributed to github-actions[bot].
+        # With these, they're attributed to your CLDMV bot App.
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/master-commit-audit.yml

@@ -0,0 +1,56 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/master-commit-audit.yml
+#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/master-commit-audit.yml
+#
+# Post-merge safety net: when any commit lands on the default branch, verify
+# its subject matches the expected release-flow patterns. On miss, auto-file a
+# GitHub Issue (deduped by SHA) so the alert is persistent and assignable —
+# not just a red ❌ that dies in inbox.
+#
+# Catches: release-workflow title-generation regressions, branch-protection
+# bypasses, unexpected bot commits, direct emergency pushes.
+#
+# Thin caller: steps, the action ref, and the canonical commit-subject pattern
+# set all live in reusable-master-commit-audit.yml@v4 (the patterns come from
+# the audit-commit-subject action's default). Nothing here can drift.
+name: 🧾 Master Commit Audit
+
+on:
+    push:
+        branches: [master, main]
+
+permissions:
+    contents: read
+    issues: write
+
+jobs:
+    audit:
+        uses: CLDMV/.github/.github/workflows/reusable-master-commit-audit.yml@v4
+        with:
+            # allowed_patterns omitted → inherit the canonical default
+            # (release + chore + merge). Uncomment ONLY if this repo lands other
+            # commit shapes directly on the default branch:
+            # allowed_patterns: |
+            #     ^release: v\d+\.\d+\.\d+( - .+?)?( \(#\d+\))?$
+            #     ^chore(\([^)]+\))?: .+
+            #     ^Merge pull request #\d+ from .+
+            #     ^feat(\([^)]+\))?: .+
+            issue_labels: "type: ci,priority: high"
+            # issue_assignee: "shinrai"   # uncomment to auto-assign
+        # Optional bot App credentials — when set, the audit issue is filed by
+        # the consumer's bot App instead of github-actions[bot]. Remove both
+        # lines to fall back to GITHUB_TOKEN.
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}