@cldmv/gh-broker 0.0.0-stage → 0.7.0

package/.github/workflows/member-auto-merge.yml

@@ -0,0 +1,75 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/member-auto-merge.yml
+#	@Date: 2026-05-28T00:00:00-07:00 (1779951600)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/member-auto-merge.yml
+#
+# Auto-enables GitHub's "auto-merge" flag on PRs opened by org members
+# against `next` or `hotfixes`, scoped to the standard branch-prefix
+# conventions (feat/, fix/, hotfix/, chore/, …). Removes the per-PR
+# friction of clicking "Enable auto-merge" — the merge still waits for
+# the ruleset's prerequisites (required approvals + CI green).
+#
+# This does NOT approve the PR. The human-review gate stays intact —
+# unlike `dependabot-auto-merge.yml` which bot-approves Dependabot bumps.
+#
+# Default in v4: ON. To opt out, delete this file — member PRs still
+# require a manual "Enable auto-merge" click but otherwise work normally.
+#
+# Required setup (one-time per repo, both done by `v4-bootstrap.yml`):
+#   1. Settings → Pull Requests → "Allow auto-merge" → ON
+#   2. A ruleset on next/hotfixes with required status checks AND a
+#      required-approving-review count ≥ 1 (the default v4 rulesets do
+#      both). The action refuses to enable auto-merge on a branch
+#      without required checks; the ruleset's approval requirement is
+#      what keeps a human in the loop after auto-merge is enabled.
+name: 🚀 Member Auto-Enable Auto-Merge
+
+on:
+    pull_request_target:
+        types: [opened, reopened, synchronize, ready_for_review]
+
+permissions:
+    contents: read
+    pull-requests: write
+
+# Collapse a burst of pushes to one run per PR; the latest state always wins.
+concurrency:
+    group: member-auto-merge-${{ github.event.pull_request.number }}
+    cancel-in-progress: true
+
+jobs:
+    enable:
+        # Pre-filter at workflow level so this doesn't spin up for every PR.
+        # The action repeats these checks for defense in depth (and clearer
+        # skip-reason logging), so trimming this `if` is fine; widening it
+        # is fine too — the action will skip anything that doesn't match.
+        if: |
+            github.event.pull_request.draft == false &&
+            (
+                github.event.pull_request.author_association == 'MEMBER' ||
+                github.event.pull_request.author_association == 'OWNER' ||
+                github.event.pull_request.author_association == 'COLLABORATOR'
+            ) &&
+            (
+                github.event.pull_request.base.ref == 'next' ||
+                github.event.pull_request.base.ref == 'hotfixes'
+            )
+        uses: CLDMV/.github/.github/workflows/reusable-member-auto-merge.yml@v4
+        with:
+            merge_method: "MERGE"
+            # CUSTOMIZE: tighten or widen as your repo requires.
+            # allowed_associations: "MEMBER,OWNER,COLLABORATOR"
+            # branch_prefixes: "feat,feature,fix,hotfix,chore,refactor,docs,ci,perf,test,style"
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/next-release.yml

@@ -0,0 +1,76 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/next-release.yml
+#	@Date: 2026-05-22T00:00:00-07:00 (1779433200)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/next-release.yml
+#
+# v4 core: maintain the ONE persistent `next → master` release PR for this repo.
+#
+# Fires on every push to `next` (contributor PR squash-merges land here).
+# Resolves the existing release PR and refreshes it, or creates it the first
+# time `next` diverges from master. The release PR batches all accumulated
+# feature commits into a single release — that batching is v4's whole point
+# (see CLDMV/.github docs/conventions/release-flow-v4.md §5.3, §6.1).
+#
+# Thin caller: all job logic (plan / create / refresh) lives in the reusable,
+# pinned at @v4. Bumping the pin carries fixes without editing this file.
+# CUSTOMIZE:
+#   - `package_name`  → your npm package (or any unique identifier)
+#   - `build_command` → your build script, or a stub like
+#                       `echo '✓ no build step'` for a meta package (optional;
+#                       defaults to `npm run build:ci`)
+name: 🚀 Next Release (v4)
+
+on:
+    push:
+        branches: [next]
+    workflow_dispatch: # manual kick — e.g. to open/refresh the PR for content already on `next`
+
+# Serialize: each run re-resolves the current PR state, so queueing (not
+# cancelling) avoids a create/refresh race when pushes land back-to-back.
+concurrency:
+    group: next-release-${{ github.repository }}
+    cancel-in-progress: false
+
+permissions:
+    contents: read
+
+jobs:
+    release:
+        permissions:
+            contents: write
+            pull-requests: write
+        uses: CLDMV/.github/.github/workflows/workflow-next-release.yml@v4
+        with:
+            package_name: "@cldmv/gh-broker"
+            build_command: "npm run build:ci"
+        secrets:
+            # Map your repo/org secrets to the expected names.
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+            # Optional: only needed if you also use reusable-lint-format.yml /
+            # reusable-coverage-badge.yml (or otherwise sign a commit locally as
+            # this identity). Passed through so the release-PR changelog
+            # recognizes that identity as a bot instead of listing it as a
+            # contributor — see CLDMV_BOT_NAME/CLDMV_BOT_EMAIL in your other
+            # workflows for the same values.
+            BOT_NAME: ${{ secrets.CLDMV_BOT_NAME }}
+            BOT_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}
+            # Optional release-PR notifier webhooks — each is independently
+            # opt-in: leave one unset and that channel is silently skipped.
+            # Delete the lines you don't use.
+            DISCORD_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PUBLIC_WEBHOOK }}
+            DISCORD_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PRIVATE_WEBHOOK }}
+            SLACK_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PUBLIC_WEBHOOK }}
+            SLACK_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PRIVATE_WEBHOOK }}
+            GENERIC_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PUBLIC_WEBHOOK }}
+            GENERIC_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PRIVATE_WEBHOOK }}

package/.github/workflows/next-reset.yml

@@ -0,0 +1,50 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/next-reset.yml
+#	@Date: 2026-05-22T00:00:00-07:00 (1779433200)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/next-reset.yml
+#
+# v4 core: after a release lands on master, re-sync the integration branches
+# (CLDMV/.github docs/conventions/release-flow-v4.md §6.3, §7).
+#
+#   - `hotfixes` is ALWAYS force-reset to master HEAD after any release.
+#   - `next` depends on which lane released:
+#       * normal release (next → master, or a v3-style feat → master):
+#         force-reset `next` to master HEAD (§7.1).
+#       * hotfix release (hotfixes → master): MERGE master into `next` instead,
+#         so next's accumulated feature work is preserved (§7.2, option B).
+#
+# Thin caller: all job logic (the wait-for-tags gate + the branch sync) lives in
+# the reusable, pinned at @v4. Bumping the pin carries fixes without editing
+# this file.
+name: ♻️ Next/Hotfixes Reset (v4)
+
+on:
+    push:
+        branches: [master, main]
+
+concurrency:
+    group: next-reset-${{ github.repository }}
+    cancel-in-progress: false
+
+permissions:
+    contents: read
+
+jobs:
+    sync:
+        permissions:
+            contents: write
+        uses: CLDMV/.github/.github/workflows/workflow-next-reset.yml@v4
+        secrets:
+            # Map your repo/org secrets to the expected names.
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/pr-notify.yml

@@ -0,0 +1,44 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/pr-notify.yml
+#	@Date: 2026-05-26T00:00:00-07:00 (1779778800)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/pr-notify.yml
+#
+# Fires once per PR open. Targets ALL PRs in the repo (including the release
+# PRs opened by the release-flow workflows) — exactly one notification per
+# PR-open event.
+#
+# Channels are addressed by secret name; no config file. Set the secret to
+# enable the channel, leave it unset to skip:
+#
+#   DISCORD_PR_PUBLIC_WEBHOOK   / DISCORD_PR_PRIVATE_WEBHOOK
+#   SLACK_PR_PUBLIC_WEBHOOK     / SLACK_PR_PRIVATE_WEBHOOK
+#   GENERIC_PR_PUBLIC_WEBHOOK   / GENERIC_PR_PRIVATE_WEBHOOK
+#
+# Visibility is determined automatically from the repo: GitHub `public` →
+# PUBLIC, `private` or `internal` → PRIVATE. Set the org-level secret in
+# CLDMV for the default URL; set a repo-level secret with the same name to
+# override (or to an empty string to mute that channel for this repo).
+name: 📥 PR Notify
+
+on:
+    pull_request:
+        types: [opened]
+
+permissions:
+    contents: read
+    pull-requests: read
+
+jobs:
+    notify:
+        uses: CLDMV/.github/.github/workflows/reusable-pr-notifier.yml@v4
+        secrets: inherit

package/.github/workflows/pr-title-normalizer.yml

@@ -0,0 +1,52 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/pr-title-normalizer.yml
+#	@Date: 2026-05-22T00:00:00-07:00 (1779433200)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/pr-title-normalizer.yml
+#
+# Normalize contributor PR titles to Conventional Commits format, derived from
+# the highest-priority commit in the PR. The release flow expects this shape, so
+# a v4 repo wants this enabled. (Also backportable to v3 repos — the underlying
+# action shipped in v3.3.0; it owns all skip logic: bot authors, the
+# long-running release PRs, titles already starting with `release:`, and titles
+# that already conform.)
+#
+# Thin caller: all job logic lives in the reusable, pinned at @v4. Bumping the
+# pin carries fixes without editing this file.
+name: 🏷️ PR Title Normalizer
+
+# SECURITY NOTE: pull_request_target runs in the BASE repo's context with WRITE
+# permissions and access to secrets. SAFE — the reusable's path is API-only (it
+# never checks out or executes PR content). Triggers on opened + synchronize
+# only (NOT edited): a maintainer hand-editing the title must not kick off a
+# re-normalize loop.
+on:
+    pull_request_target:
+        types: [opened, synchronize]
+
+concurrency:
+    group: pr-title-normalizer-${{ github.event.pull_request.number }}
+    cancel-in-progress: true
+
+permissions:
+    contents: read
+
+jobs:
+    normalize:
+        permissions:
+            contents: read
+            pull-requests: write
+        uses: CLDMV/.github/.github/workflows/workflow-pr-title-normalizer.yml@v4
+        secrets:
+            # Map your repo/org secrets to the expected names.
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/provenance.yml

@@ -0,0 +1,51 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/provenance.yml
+#	@Date: 2026-09-05T00:00:00-07:00 (1788591600)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# SLSA build provenance (.intoto.jsonl) for this repo's published releases.
+# Decoupled from the publish workflow on purpose (see reusable-provenance.yml):
+# the SLSA generator is a reusable-workflow call and cannot carry
+# `continue-on-error`, so running it here — on its own `release: published`
+# trigger — keeps a provenance failure from ever turning a release run red
+# (issue #268). It re-packs the SAME build artifact the publish run uploaded, so
+# the signed subjects are byte-identical to what was published.
+#
+# Prereq: the org's allowed actions/reusable-workflows policy must permit
+# slsa-framework/*.
+name: 🔏 SLSA Provenance
+
+on:
+    release:
+        types: [published]
+
+jobs:
+    provenance:
+        # Public, real releases only — SLSA provenance is recorded in the public
+        # Rekor transparency log. Skip drafts, prereleases, and private repos.
+        if: |
+            !github.event.repository.private &&
+            !github.event.release.draft &&
+            !github.event.release.prerelease
+        permissions:
+            actions: read # look up the publish run's build artifact
+            id-token: write # provenance signing (OIDC)
+            contents: write # upload the .intoto.jsonl release asset
+        uses: CLDMV/.github/.github/workflows/reusable-provenance.yml@v4
+        with:
+            tag: ${{ github.event.release.tag_name }}
+            # CUSTOMIZE: these MUST match your publish.yml so the re-packed
+            # tarballs are byte-identical to what was published.
+            package_name: "@cldmv/gh-broker"
+            node_version: "lts/*"
+            # Satellite packages (same value as publish.yml's extra_packages);
+            # empty disables. See docs/conventions/satellite-packages.md.
+            extra_packages: ""

package/.github/workflows/publish.yml

@@ -0,0 +1,146 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/publish.yml
+#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/publish.yml
+name: 📦 Release and Publish
+
+on:
+    push:
+        branches: [master, main]
+        paths-ignore:
+            - "**.md"
+            - ".github/ISSUE_TEMPLATE/**"
+            - ".github/PULL_REQUEST_TEMPLATE/**"
+    workflow_dispatch:
+        inputs:
+            debug:
+                description: "Enable debug logging for troubleshooting"
+                type: boolean
+                required: false
+                default: false
+            dry_run:
+                description: "Dry run mode - validate everything but don't publish or create releases"
+                type: boolean
+                required: false
+                default: false
+            node_version:
+                description: "Node.js version to use (default: lts/*)"
+                type: string
+                required: false
+                default: "lts/*"
+            package_manager:
+                description: "Package manager (npm or yarn)"
+                type: string
+                required: false
+                default: "npm"
+            test_environment:
+                description: "Environment for tests (affects NODE_ENV and NODE_OPTIONS --conditions flag)"
+                type: string
+                required: false
+                default: "development"
+            version:
+                description: "Version to publish (auto-detected from package.json if not provided)"
+                type: string
+                required: false
+                default: ""
+            publish_to_npm:
+                description: "Publish to NPM registry"
+                type: boolean
+                required: false
+                default: true
+            publish_to_github_packages:
+                description: "Publish to GitHub Packages registry"
+                type: boolean
+                required: false
+                default: true
+            min_node_version:
+                description: "Minimum Node.js version for matrix testing (enables matrix when set; default: 22.12.0 — the floor vitest 5 actually runs on)"
+                type: string
+                required: false
+                default: "22.12.0"
+            max_node_major:
+                description: "Max Node.js major version for the test matrix. Leave blank (the default) to inherit the CLDMV/.github reusable workflow's default; set a value only to pin/override for a specific run."
+                type: string
+                required: false
+                default: ""
+            use_gpg:
+                description: "Enable GPG signing (if GPG secrets provided)"
+                type: boolean
+                required: false
+                default: false
+
+# NEVER cancel an in-flight publish — half-published versions are nasty to
+# clean up. Concurrent publishes for the same ref queue instead so they
+# serialize naturally.
+concurrency:
+    group: publish-${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: false
+
+permissions:
+    contents: read
+
+jobs:
+    publish-package:
+        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
+        permissions:
+            contents: write
+            packages: write
+            id-token: write
+        uses: CLDMV/.github/.github/workflows/workflow-publish.yml@v4
+        with:
+            package_name: "@cldmv/gh-broker" # Required: replace with your NPM package name
+            debug: ${{ github.event.inputs.debug == 'true' }}
+            dry_run: ${{ github.event.inputs.dry_run == 'true' }}
+            node_version: ${{ github.event.inputs.node_version || 'lts/*' }}
+            package_manager: ${{ github.event.inputs.package_manager || 'npm' }}
+            version: ${{ github.event.inputs.version || '' }}
+            publish_to_npm: ${{ github.event.inputs.publish_to_npm != 'false' }}
+            publish_to_github_packages: ${{ github.event.inputs.publish_to_github_packages != 'false' }}
+            publish_command: ""
+            github_packages_publish_command: ""
+            min_node_version: ${{ github.event.inputs.min_node_version || '22.12.0' }}
+            max_node_major: ${{ github.event.inputs.max_node_major || '' }} # blank ⇒ inherit the CLDMV/.github reusable default
+            test_command: "npm test" # Use defaults: NODE_ENV=development, NODE_OPTIONS=--conditions=development
+            # test_command: "NODE_OPTIONS='--conditions=slothlet-dev' npm test"  # Override NODE_OPTIONS only
+            # test_command: "NODE_ENV=test npm test"  # Override NODE_ENV only
+            # test_command: "NODE_ENV=test NODE_OPTIONS='--conditions=slothlet-dev' npm test"  # Override both
+            test_environment: ${{ github.event.inputs.test_environment || 'development' }} # Alternative to setting in test_command
+            build_command: "npm run build:ci"
+            # --- Satellite packages (optional) ----------------------------------------
+            # Publish extra packages carved from this build's output (e.g. locale JSON,
+            # generated types) at the SAME version/commit as the core, each with its own
+            # @scope/name@version tag + GitHub Release. Uncomment to opt in.
+            #   extra_packages: a JSON [{ name, dir }] array, OR a glob (single '*' in the
+            #   final path segment, e.g. "dist-packages/*"). Empty = disabled.
+            #   build_subpackages_command: runs after build_command to produce
+            #   dist-packages/<name>/ — omit if build_command already does the carve.
+            # First publish of each new @scope/name needs a one-time token publish +
+            # trusted-publisher setup. Full details + the contract:
+            # docs/conventions/satellite-packages.md
+            # extra_packages: "dist-packages/*"
+            # build_subpackages_command: "npm run build:subpackages"
+            # --------------------------------------------------------------------------
+            is_prerelease: false
+            release_source_only: false
+            create_documentation: true
+            skip_performance_tests: false
+            skip_matrix_tests: false
+            use_gpg: ${{ github.event.inputs.use_gpg == 'true' }}
+        secrets:
+            NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+            TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }}
+            TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}
+            GPG_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_GPG_PRIVATE_KEY }}
+            GPG_PASSPHRASE: ${{ secrets.CLDMV_BOT_GPG_PASSPHRASE }}

package/.github/workflows/release-merge.yml

@@ -0,0 +1,104 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/release-merge.yml
+#	@Date: 2026-09-29T02:39:40+00:00 (1790649580)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/release-merge.yml
+#
+# v4 core (optional): squash-merge the persistent `next → master` release PR on
+# YOUR APPROVAL, via the REST merge API with the PR body as the commit message.
+#
+# Why not just click "Squash and merge"? The mobile Default path can land a
+# title-only commit (dropping the curated changelog + coverage), and the web/
+# mobile squash UI auto-appends its own `Co-authored-by:` list (not deduped, not
+# bot-stripped). An explicit-message API merge avoids both — the release commit
+# is exactly the curated PR body. It also merges only once EVERY check (required
+# AND non-required, e.g. the coverage badge and the release-PR body refresh) has
+# finished and passed, so the body it captures is never stale.
+#
+# How you use it: approve the release PR as you normally do. The merge fires when
+# CI is green — if you approve before CI finishes, it re-evaluates once CI
+# actually finishes and merges once the last check passes. Nothing auto-merges
+# without your approval.
+#
+# Re-evaluation uses `workflow_run`, not `check_suite` — GitHub does not send
+# `check_suite: completed` for a suite created by GitHub Actions itself, which
+# is every check your own ci.yml produces; it only fires for a suite created
+# by a third-party App. See CLDMV/.github#318: an approval given before CI
+# finished left a release PR stuck fully green with nothing re-firing the
+# merge check, because check_suite silently never fired for that case at all.
+# `workflow_run` is GitHub's documented replacement for exactly this pattern.
+#
+# IMPORTANT: the merge gate waits on EVERY check-run on the release PR's head
+# commit, from any workflow — so `workflows:` below must name every workflow in
+# your repo that puts a check on that commit, not just ci.yml. Only the one that
+# finishes LAST can see a fully green head; if it isn't listed, nothing re-fires
+# and the PR sits approved + green until you dispatch this workflow by hand.
+# CodeQL in particular routinely outlasts ci.yml (CLDMV/.github PR #322 stuck
+# exactly this way). The list below covers the standard v4 template set by their
+# template `name:`s — names are matched literally (not by filename), so fix any
+# you renamed, and add any extra PR-triggered workflow your repo has. Listing a
+# workflow your repo doesn't have is harmless. `branches:` limits re-fires to
+# runs on the integration branches, so feature-branch CI doesn't wake this up.
+#
+# Thin caller: all logic lives in the reusable, pinned at @v4.
+# NOTE: pull_request_review / workflow_run events run the copy of this file on
+# the DEFAULT branch, so it takes effect once it ships to master with a release.
+name: 🚦 Release Merge (v4)
+
+on:
+    pull_request_review:
+        types: [submitted] # your approval arms it
+    workflow_run: # re-evaluate as each check-producing workflow finishes — see #318
+        workflows: # ← must match your workflows' `name:`s — see IMPORTANT above
+            - "🧪 CI Tests & Build"
+            - "🔍 CodeQL"
+            - "🔒 Dependency Review"
+            - "📊 Bundle Size"
+            - "🚀 Next Release (v4)"
+            - "🚑 Hotfixes Release (v4)"
+            - "🌿 Branch Retention"
+            - "🏷️ PR Labeler"
+            - "🏷️ PR Title Normalizer"
+            - "👋 Welcome Contributor"
+            - "🔀 Hotfix PR Redirector (v4)"
+            - "🚀 Member Auto-Enable Auto-Merge"
+            - "🤖 Dependabot Auto-Merge"
+            - "🔁 Dependabot Auto-Recreate"
+            - "📜 CLA"
+            - "📥 PR Notify"
+        types: [completed]
+        branches: [next, hotfixes]
+    workflow_dispatch: # manual re-evaluation
+
+# Serialize per repo: each run re-resolves the release PR + re-gates the head,
+# so queue (don't cancel) to avoid racing a merge that's already in flight.
+# GitHub keeps one pending run per group and a newer arrival replaces it — that
+# is harmless, since every run re-reads approval + check state from the API.
+concurrency:
+    group: release-merge-${{ github.repository }}
+    cancel-in-progress: false
+
+permissions:
+    contents: read
+
+jobs:
+    merge:
+        permissions:
+            contents: write
+            pull-requests: write
+            checks: read
+            statuses: read
+        uses: CLDMV/.github/.github/workflows/workflow-release-merge.yml@v4
+        secrets:
+            # Map your repo/org secrets to the expected names.
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/release-notify.yml

@@ -0,0 +1,41 @@
+#
+#	@Project: @cldmv/gh-broker
+#	@Filename: /.github/workflows/release-notify.yml
+#	@Date: 2026-07-19T00:00:00-07:00 (1784444400)
+#	@Author: Nate Corcoran <CLDMV>
+#	@Email: <Shinrai@users.noreply.github.com>
+#	-----
+#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
+#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
+#	-----
+#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/release-notify.yml
+#
+# Fires on `release: published` and dispatches the release announcement to
+# any enabled webhook. No config file — each channel is just a secret:
+#
+#   DISCORD_RELEASES_PUBLIC_WEBHOOK   / DISCORD_RELEASES_PRIVATE_WEBHOOK
+#   SLACK_RELEASES_PUBLIC_WEBHOOK     / SLACK_RELEASES_PRIVATE_WEBHOOK
+#   GENERIC_RELEASES_PUBLIC_WEBHOOK   / GENERIC_RELEASES_PRIVATE_WEBHOOK
+#
+# Visibility is determined automatically from the repo: GitHub `public` →
+# PUBLIC, `private` or `internal` → PRIVATE. Set the org-level secret in
+# CLDMV for the default URL; set a repo-level secret with the same name to
+# override (or to an empty string to mute that channel for this repo).
+name: 📣 Release Notify
+
+on:
+    release:
+        types: [published]
+
+permissions:
+    contents: read
+
+jobs:
+    notify:
+        # Defensive: skip untagged releases (mirrors Batch 1.2's filter)
+        if: github.event.release.tag_name != ''
+        uses: CLDMV/.github/.github/workflows/reusable-release-notifier.yml@v4
+        secrets: inherit