@cldmv/gh-broker 0.7.0 → 0.8.0

package/.github/workflows/update-major-version-tags.yml

@@ -1,94 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/update-major-version-tags.yml
-#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/update-major-version-tags.yml
-name: 🏷️ Update Major Version Tags
-
-on:
-    release:
-        types: [published]
-    workflow_dispatch:
-        inputs:
-            debug:
-                description: "Enable debug logging for troubleshooting"
-                type: boolean
-                required: false
-                default: false
-            create_documentation:
-                description: "Whether to create/update VERSION_TAGS.md documentation"
-                type: boolean
-                required: false
-                default: false
-            use_gpg:
-                description: "Enable GPG signing (if GPG secrets provided)"
-                type: boolean
-                required: false
-                default: true
-            # Tag health configuration
-            max_tags:
-                description: "Maximum number of tags to process (safety limit)"
-                required: false
-                default: "100"
-            max_major_versions:
-                description: "Maximum number of major versions to process"
-                required: false
-                default: "10"
-            max_minor_versions:
-                description: "Maximum number of minor versions per major to process"
-                required: false
-                default: "10"
-            bot_patterns:
-                description: "JSON array of bot name patterns to identify bot signatures"
-                required: false
-                default: '["CLDMV Bot", "cldmv-bot", "github-actions[bot]"]'
-            include_patterns:
-                description: "JSON array of tag patterns to include (e.g. ['v*', 'release-*'])"
-                required: false
-                default: '["v*"]'
-            exclude_patterns:
-                description: "JSON array of tag patterns to exclude"
-                required: false
-                default: "[]"
-
-permissions:
-    contents: read
-
-jobs:
-    update-tags:
-        # Skip release events fired without a tag_name (e.g. "untagged-<sha>" runs
-        # the bot or a prior code path can produce). The reusable workflow has its
-        # own tag-readiness polling for forward-facing prevention; this guard
-        # protects against legacy / external sources of untagged release events.
-        # Batch 1.2 from tmp/plan-future-workflows.md.
-        if: github.event_name != 'release' || github.event.release.tag_name != ''
-        uses: CLDMV/.github/.github/workflows/workflow-update-major-version-tags.yml@v4
-        permissions:
-            contents: write
-        with:
-            debug: ${{ github.event.inputs.debug == 'true' }}
-            create_documentation: ${{ github.event.inputs.create_documentation == 'true' }}
-            use_gpg: ${{ github.event.inputs.use_gpg != 'false' }}
-            max_tags: ${{ github.event.inputs.max_tags || '100' }}
-            max_major_versions: ${{ github.event.inputs.max_major_versions || '10' }}
-            max_minor_versions: ${{ github.event.inputs.max_minor_versions || '10' }}
-            bot_patterns: ${{ github.event.inputs.bot_patterns || '["CLDMV Bot", "cldmv-bot", "github-actions[bot]"]' }}
-            include_patterns: ${{ github.event.inputs.include_patterns || '["v*"]' }}
-            exclude_patterns: ${{ github.event.inputs.exclude_patterns || '[]' }}
-        secrets:
-            # Map your repo/org secrets to the expected names
-            TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }}
-            TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}
-            GPG_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_GPG_PRIVATE_KEY }}
-            GPG_PASSPHRASE: ${{ secrets.CLDMV_BOT_GPG_PASSPHRASE }}
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/v4-bootstrap.yml

@@ -1,115 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/v4-bootstrap.yml
-#	@Date: 2026-05-26T00:00:00-07:00 (1779778800)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/v4-bootstrap.yml
-#
-# Per-repo v4 bootstrap — thin wrapper around the shared
-# `org-bootstrap-repo@v4` action. Run once per repo from the Actions tab
-# (or, for org-wide rollout, prefer `local-org-onboarding.yml` in
-# CLDMV/.github which fans out across many repos in parallel).
-#
-# What gets applied (overwrite-with-warn — divergences are surfaced in the
-# run summary):
-#   - `next` + `hotfixes` branches created from master HEAD if missing
-#   - repo settings: allow_auto_merge=true, delete_branch_on_merge=false,
-#     allow_squash_merge=true, allow_merge_commit=true,
-#     allow_rebase_merge=false, allow_update_branch=true; plus PR-merge
-#     dialog defaults (merge_commit_title / squash_merge_commit_title =
-#     PR_TITLE, merge_commit_message / squash_merge_commit_message =
-#     PR_BODY) so the resulting commit captures the PR title + body
-#     verbatim (release-PR body = the categorized changelog → lands on
-#     master). Per-branch ruleset allowed_merge_methods picks the method.
-#   - security toggles: dependabot alerts + security updates, secret
-#     scanning + push protection, private vulnerability reporting
-#   - rulesets: replaces the three rulesets (Protect Master/Next/Hotfixes)
-#     with the org canonical defaults
-#
-# What is NOT applied (GitHub doesn't expose it via REST / GraphQL / gh CLI
-# — confirmed against community/community#188598; the bootstrap surfaces
-# this as a 'Manual one-time toggles' line in the run summary):
-#   - Settings → General → Pull Requests → "Auto-close issues with merged
-#     linked pull requests" (recommended ON). Toggle in the repo UI once.
-#
-# Idempotent — re-running is safe. Default `dry_run: true` previews
-# everything before applying.
-#
-# Full design: CLDMV/.github docs/conventions/release-flow-v4.md
-# Migration checklist: CLDMV/.github docs/migration/v3-to-v4.md
-name: 🚀 v4 Bootstrap
-
-on:
-    workflow_dispatch:
-        inputs:
-            dry_run:
-                description: "Dry-run: preview every mutation without firing it. Default `true` — set to `false` to actually apply changes."
-                type: boolean
-                required: false
-                default: true
-            code_security:
-                description: "Code Security policy. off = disable. public-only = enable only if this repo is public (free). all = enable (paid on private)."
-                type: choice
-                required: false
-                default: "off"
-                options:
-                    - "off"
-                    - "public-only"
-                    - "all"
-            secret_protection:
-                description: "Secret Protection (scanning + push protection) policy. Same shape as code_security."
-                type: choice
-                required: false
-                default: "off"
-                options:
-                    - "off"
-                    - "public-only"
-                    - "all"
-            steps:
-                description: "Subset of phases to run, comma-separated."
-                required: false
-                default: "branches,settings,security,rulesets,variables"
-            code_scanning_config:
-                description: "Override for the variables-phase GHAS config (scan/skip lists): inline JSON or a workspace path. Empty = the data/code-scanning-skips.json bundled in CLDMV/.github — third-party orgs supply their own here."
-                required: false
-                default: ""
-
-permissions:
-    contents: read
-
-jobs:
-    bootstrap:
-        name: "🚀 Bootstrap v4 (this repo)"
-        runs-on: ubuntu-latest
-        steps:
-            - name: Create App token
-              id: app-token
-              # Full-permission App token — bootstrap needs administration:write
-              # for security toggles + ruleset import, plus contents:write for
-              # branch creation.
-              uses: CLDMV/.github/.github/actions/github/steps/create-app-token@v4
-              with:
-                  client_id: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-                  private_key: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
-              env:
-                  BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-                  BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
-
-            - name: Bootstrap
-              uses: CLDMV/.github/.github/actions/github/jobs/org-bootstrap-repo@v4
-              with:
-                  # target_repo defaults to GITHUB_REPOSITORY (this repo).
-                  github_token: ${{ steps.app-token.outputs.token }}
-                  dry_run: ${{ github.event.inputs.dry_run }}
-                  steps: ${{ github.event.inputs.steps }}
-                  code_security: ${{ github.event.inputs.code_security }}
-                  secret_protection: ${{ github.event.inputs.secret_protection }}
-                  code_scanning_config: ${{ github.event.inputs.code_scanning_config }}

package/.github/workflows/welcome.yml

@@ -1,42 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/welcome.yml
-#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:58-07:00 (1790965858)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/welcome.yml
-#
-# Batch 5.3 from tmp/plan-future-workflows.md.
-name: 👋 Welcome Contributor
-
-# SECURITY NOTE: pull_request_target runs in the BASE repo's context with
-# WRITE permissions and access to secrets. SAFE for THIS workflow because:
-#   - We never checkout the PR head ref
-#   - We never run code from the PR (no `run:` step uses PR data)
-#   - We only call REST APIs to read prior interactions and post a comment
-# DO NOT add a checkout step or any step that executes PR-supplied content.
-on:
-    issues:
-        types: [opened]
-    pull_request_target:
-        types: [opened]
-
-permissions:
-    issues: write
-    pull-requests: write
-
-jobs:
-    welcome:
-        uses: CLDMV/.github/.github/workflows/reusable-welcome.yml@v4
-        # Optional. Without these, the welcome comment is posted by
-        # github-actions[bot]. With these, it's posted by your CLDMV bot App.
-        secrets:
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}