@cldmv/gh-broker 0.7.0 → 0.9.0

package/.github/workflows/dependabot-recreate.yml

@@ -1,67 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/dependabot-recreate.yml
-#	@Date: 2026-07-31T00:00:00-07:00 (1785481200)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/dependabot-recreate.yml
-#
-# Auto-fires `@dependabot recreate` when a Dependabot PR gets stuck in the
-# "edited by someone other than Dependabot" state. That state breaks
-# `@dependabot rebase` and — under a required-signed-commits ruleset — blocks
-# the PR with an unsigned commit. `recreate` rebuilds it as a fresh, signed
-# Dependabot commit that dependabot-auto-merge.yml then merges. See
-# reusable-dependabot-recreate.yml for the mechanics + the command-actor caveat.
-#
-# Default in v4: ON. Delete this file to opt out entirely; add a `no-recreate`
-# label to a specific PR to exempt just that one (e.g. one you've hand-edited
-# on purpose and don't want overwritten).
-#
-# Triggers:
-#   - issue_comment: catches Dependabot's own "can't rebase, use recreate" reply
-#     (Dependabot only comments back when a rebase FAILS — success is a silent
-#     👍 + force-push).
-#   - pull_request_target: proactive net for a Dependabot PR whose head commit
-#     is unverified. pull_request_target (not pull_request) is required so the
-#     job can read the bot-App secrets — Dependabot-triggered `pull_request`
-#     runs get a read-only token and no secrets. It is SAFE here: Dependabot PRs
-#     are same-repo branches (not forks), and this workflow never checks out or
-#     runs PR code — it only reads the PR and posts a comment via the API.
-name: 🔁 Dependabot Auto-Recreate
-
-on:
-    issue_comment:
-        types: [created]
-    pull_request_target:
-        types: [opened, synchronize, reopened]
-
-permissions:
-    contents: read
-    pull-requests: write
-    issues: write
-
-jobs:
-    recreate:
-        # A) Dependabot replied that it can't rebase (the PR was edited), or
-        # B) a Dependabot PR opened/updated — the reusable then checks whether
-        #    its head commit is actually unverified before doing anything.
-        if: >-
-            (github.event_name == 'issue_comment'
-              && github.event.issue.pull_request
-              && github.event.comment.user.login == 'dependabot[bot]'
-              && contains(github.event.comment.body, 'edited by someone other than Dependabot'))
-            || (github.event_name == 'pull_request_target'
-              && github.event.pull_request.user.login == 'dependabot[bot]')
-        uses: CLDMV/.github/.github/workflows/reusable-dependabot-recreate.yml@v4
-        with:
-            skip_label: "no-recreate"
-        secrets:
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/dependency-review.yml

@@ -1,46 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/dependency-review.yml
-#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/dependency-review.yml
-#
-# PRIVATE REPOS are skipped by DEFAULT (the dependency-review API needs
-# GitHub Advanced Security there): the bootstrap's `variables` phase sets
-# CLDMV_SKIP_DEPENDENCY_REVIEW on every private repo not opted into the
-# `scan` list in data/code-scanning-skips.json in CLDMV/.github. To run the
-# review on a private repo, pay for Code Security and add it to that list.
-# Consumers outside CLDMV can pass `skip_dependency_review: true` below
-# instead.
-name: 🔒 Dependency Review
-
-on:
-    pull_request:
-        types: [opened, synchronize, reopened, ready_for_review]
-        branches: [master, main]
-
-permissions:
-    contents: read
-    pull-requests: write
-
-jobs:
-    review:
-        uses: CLDMV/.github/.github/workflows/reusable-dependency-review.yml@v4
-        with:
-            fail_on_severity: "moderate"
-            # Per-repo license policy override:
-            # deny_licenses: "AGPL-3.0,LGPL-3.0"   # block copyleft for an Apache-2.0 repo
-        # Bot App credentials. When set, the dependency-review PR comment is
-        # posted by the consumer's bot App instead of github-actions[bot].
-        # Both lines are optional; remove them to fall back to GITHUB_TOKEN.
-        secrets:
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/feature-pr.yml

@@ -1,75 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/feature-pr.yml
-#	@Date: 2026-08-02T16:55:52-07:00 (1785714952)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/feature-pr.yml
-#
-# v4 ergonomics: auto-opens (and refreshes) a PR from a code-side branch to the
-# right integration branch on every push.
-#
-# Mapping (matches CLDMV/.github docs/conventions/branch-naming.md):
-#   feat/*, feature/*, fix/*, release/*, chore/*, deps/*, refactor/*,
-#   docs/*, ci/*, perf/*, test/*, style/*           → next
-#   hotfix/*                                         → hotfixes
-#
-# Reserved branches NOT auto-PR'd: dependabot/* and copilot/* (they manage their
-# own PRs); badges, gh-pages (bot-only); master/main (the target).
-#
-# Thin caller: all job logic (target detection, changelog body, PR create/
-# refresh) lives in the reusable, pinned at @v4. Bumping the pin carries fixes
-# without editing this file. The `push` trigger and its branch-prefix list stay
-# here (GitHub requires the trigger local, and the list is per-repo config).
-name: 🔀 Feature PR (v4)
-
-on:
-    push:
-        branches:
-            # CUSTOMIZE: prune this list to whichever branch prefixes your
-            # repo uses. Must align with the `case` statement in the reusable.
-            - 'feat/**'
-            - 'feature/**'
-            - 'fix/**'
-            - 'release/**'
-            - 'chore/**'
-            - 'deps/**'
-            - 'refactor/**'
-            - 'docs/**'
-            - 'ci/**'
-            - 'perf/**'
-            - 'test/**'
-            - 'style/**'
-            - 'hotfix/**'
-
-concurrency:
-    group: feature-pr-${{ github.repository }}-${{ github.ref }}
-    cancel-in-progress: false
-
-permissions:
-    contents: read
-
-jobs:
-    open-pr:
-        permissions:
-            contents: read
-            pull-requests: write
-        uses: CLDMV/.github/.github/workflows/workflow-feature-pr.yml@v4
-        secrets:
-            # Map your repo/org secrets to the expected names.
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
-            # Optional: only needed if you also use reusable-lint-format.yml /
-            # reusable-coverage-badge.yml (or otherwise sign a commit locally as
-            # this identity). Passed through so this PR's changelog body
-            # recognizes that identity as a bot instead of listing it as a
-            # contributor.
-            BOT_NAME: ${{ secrets.CLDMV_BOT_NAME }}
-            BOT_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}

package/.github/workflows/hotfix-redirector.yml

@@ -1,67 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/hotfix-redirector.yml
-#	@Date: 2026-05-22T00:00:00-07:00 (1779433200)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/hotfix-redirector.yml
-#
-# v4 hotfix lane: retarget hotfix/security PRs to the `hotfixes` branch.
-#
-# Two paths trigger a redirect (CLDMV/.github docs/conventions/release-flow-v4.md §5.2, §6.5):
-#   1. Head branch matches `hotfix/*` or `security/*` (human-driven hotfix flow).
-#   2. Author is `dependabot[bot]` AND its base isn't Dependabot's routine
-#      target-branch (default "next") — GitHub always overrides dependabot.yml's
-#      target-branch for security updates, so a base landing on the default
-#      branch instead of "next" is itself the signal. Routine version bumps stay
-#      on "next".
-#
-# Thin caller: all job logic (token, checkout, git identity, redirect action)
-# lives in the reusable, pinned at @v4. Bumping the pin carries new requirements
-# (e.g. the checkout + git identity the cherry-pick path needs) without editing
-# this file.
-name: 🔀 Hotfix PR Redirector (v4)
-
-# SECURITY NOTE: pull_request_target runs in the BASE repo's context with WRITE
-# permissions + secrets. The reusable checks out `hotfixes` (a trusted base-repo
-# branch, NOT the PR head/fork) and only cherry-picks/pushes against it.
-#
-# `opened` only (NOT `edited`): if a maintainer manually re-targets the PR, we
-# must not fight them by redirecting again.
-on:
-    pull_request_target:
-        types: [opened]
-
-concurrency:
-    group: hotfix-redirector-${{ github.event.pull_request.number }}
-    cancel-in-progress: true
-
-permissions:
-    contents: read
-
-jobs:
-    redirect:
-        permissions:
-            contents: write
-            pull-requests: write
-        uses: CLDMV/.github/.github/workflows/workflow-hotfix-redirector.yml@v4
-        secrets:
-            # Map your repo/org secrets to the expected names.
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
-            # GPG signing identity — REQUIRED if this repo redirects Dependabot
-            # SECURITY PRs: that path cherry-picks a commit onto `hotfixes`, and
-            # an unsigned commit is silently blocked by required-signatures (no
-            # failing check names the cause). The commit is signed and authored as
-            # this real-user bot account (the GPG key's owner), not the App bot.
-            BOT_NAME: ${{ secrets.CLDMV_BOT_NAME }}
-            BOT_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}
-            BOT_GPG_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_GPG_PRIVATE_KEY }}
-            BOT_GPG_PASSPHRASE: ${{ secrets.CLDMV_BOT_GPG_PASSPHRASE }}

package/.github/workflows/hotfixes-release.yml

@@ -1,70 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/hotfixes-release.yml
-#	@Date: 2026-05-22T00:00:00-07:00 (1779433200)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/hotfixes-release.yml
-#
-# v4 hotfix lane: maintain the ONE persistent `hotfixes → master` release PR.
-#
-# Mirror of next-release.yml but for the `hotfixes` integration branch
-# (CLDMV/.github docs/conventions/release-flow-v4.md §5.4, §6.2). Fires on every
-# push to `hotfixes` (hotfix/security PR squash-merges land here), and
-# resolves-or-creates the persistent `hotfixes → master` release PR.
-#
-# Thin caller: all job logic (plan / create / refresh) lives in the reusable,
-# pinned at @v4. Bumping the pin carries fixes without editing this file.
-# CUSTOMIZE `package_name` / `build_command` to match your package (same values
-# as your next-release.yml).
-name: 🚑 Hotfixes Release (v4)
-
-on:
-    push:
-        branches: [hotfixes]
-    workflow_dispatch: # manual kick — e.g. to open/refresh the PR for content already on `hotfixes`
-
-concurrency:
-    group: hotfixes-release-${{ github.repository }}
-    cancel-in-progress: false
-
-permissions:
-    contents: read
-
-jobs:
-    release:
-        permissions:
-            contents: write
-            pull-requests: write
-        uses: CLDMV/.github/.github/workflows/workflow-hotfixes-release.yml@v4
-        with:
-            package_name: "@cldmv/gh-broker"
-            build_command: "npm run build:ci"
-        secrets:
-            # Map your repo/org secrets to the expected names.
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
-            # Optional: only needed if you also use reusable-lint-format.yml /
-            # reusable-coverage-badge.yml (or otherwise sign a commit locally as
-            # this identity). Passed through so the release-PR changelog
-            # recognizes that identity as a bot instead of listing it as a
-            # contributor — see CLDMV_BOT_NAME/CLDMV_BOT_EMAIL in your other
-            # workflows for the same values.
-            BOT_NAME: ${{ secrets.CLDMV_BOT_NAME }}
-            BOT_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}
-            # Optional release-PR notifier webhooks — each is independently
-            # opt-in: leave one unset and that channel is silently skipped.
-            # Delete the lines you don't use.
-            DISCORD_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PUBLIC_WEBHOOK }}
-            DISCORD_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PRIVATE_WEBHOOK }}
-            SLACK_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PUBLIC_WEBHOOK }}
-            SLACK_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PRIVATE_WEBHOOK }}
-            GENERIC_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PUBLIC_WEBHOOK }}
-            GENERIC_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PRIVATE_WEBHOOK }}

package/.github/workflows/labeler.yml

@@ -1,48 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/labeler.yml
-#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/labeler.yml
-#
-# Path-based PR auto-labeler. Uses CLDMV's org-default labeler.default.yml;
-# override per-repo by adding .github/labeler.yml in this repo (same shape).
-#
-# Labels applied additively — never removes labels added by humans or other
-# automation.
-#
-# Batch 5.2 from tmp/plan-future-workflows.md.
-name: 🏷️ PR Labeler
-
-# SECURITY NOTE: This workflow uses pull_request_target so it can apply labels
-# to fork PRs. pull_request_target runs in the BASE repo's context with WRITE
-# permissions and access to secrets. This is SAFE for THIS workflow because:
-#   - We never checkout the PR head ref
-#   - We never run code from the PR (no `run:` step uses PR data)
-#   - We only call REST APIs to read the file list and post labels
-# DO NOT add a checkout step or any step that executes PR-supplied content
-# (build commands, scripts, test runs, etc.) to this workflow.
-on:
-    pull_request_target:
-        types: [opened, synchronize, reopened, ready_for_review]
-
-permissions:
-    contents: read
-    pull-requests: write
-
-jobs:
-    label:
-        uses: CLDMV/.github/.github/workflows/reusable-pr-labeler.yml@v4
-        # Optional. Without these, labels are attributed to github-actions[bot].
-        # With these, they're attributed to your CLDMV bot App.
-        secrets:
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/master-commit-audit.yml

@@ -1,56 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/master-commit-audit.yml
-#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/master-commit-audit.yml
-#
-# Post-merge safety net: when any commit lands on the default branch, verify
-# its subject matches the expected release-flow patterns. On miss, auto-file a
-# GitHub Issue (deduped by SHA) so the alert is persistent and assignable —
-# not just a red ❌ that dies in inbox.
-#
-# Catches: release-workflow title-generation regressions, branch-protection
-# bypasses, unexpected bot commits, direct emergency pushes.
-#
-# Thin caller: steps, the action ref, and the canonical commit-subject pattern
-# set all live in reusable-master-commit-audit.yml@v4 (the patterns come from
-# the audit-commit-subject action's default). Nothing here can drift.
-name: 🧾 Master Commit Audit
-
-on:
-    push:
-        branches: [master, main]
-
-permissions:
-    contents: read
-    issues: write
-
-jobs:
-    audit:
-        uses: CLDMV/.github/.github/workflows/reusable-master-commit-audit.yml@v4
-        with:
-            # allowed_patterns omitted → inherit the canonical default
-            # (release + chore + merge). Uncomment ONLY if this repo lands other
-            # commit shapes directly on the default branch:
-            # allowed_patterns: |
-            #     ^release: v\d+\.\d+\.\d+( - .+?)?( \(#\d+\))?$
-            #     ^chore(\([^)]+\))?: .+
-            #     ^Merge pull request #\d+ from .+
-            #     ^feat(\([^)]+\))?: .+
-            issue_labels: "type: ci,priority: high"
-            # issue_assignee: "shinrai"   # uncomment to auto-assign
-        # Optional bot App credentials — when set, the audit issue is filed by
-        # the consumer's bot App instead of github-actions[bot]. Remove both
-        # lines to fall back to GITHUB_TOKEN.
-        secrets:
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/member-auto-merge.yml

@@ -1,75 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/member-auto-merge.yml
-#	@Date: 2026-05-28T00:00:00-07:00 (1779951600)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/member-auto-merge.yml
-#
-# Auto-enables GitHub's "auto-merge" flag on PRs opened by org members
-# against `next` or `hotfixes`, scoped to the standard branch-prefix
-# conventions (feat/, fix/, hotfix/, chore/, …). Removes the per-PR
-# friction of clicking "Enable auto-merge" — the merge still waits for
-# the ruleset's prerequisites (required approvals + CI green).
-#
-# This does NOT approve the PR. The human-review gate stays intact —
-# unlike `dependabot-auto-merge.yml` which bot-approves Dependabot bumps.
-#
-# Default in v4: ON. To opt out, delete this file — member PRs still
-# require a manual "Enable auto-merge" click but otherwise work normally.
-#
-# Required setup (one-time per repo, both done by `v4-bootstrap.yml`):
-#   1. Settings → Pull Requests → "Allow auto-merge" → ON
-#   2. A ruleset on next/hotfixes with required status checks AND a
-#      required-approving-review count ≥ 1 (the default v4 rulesets do
-#      both). The action refuses to enable auto-merge on a branch
-#      without required checks; the ruleset's approval requirement is
-#      what keeps a human in the loop after auto-merge is enabled.
-name: 🚀 Member Auto-Enable Auto-Merge
-
-on:
-    pull_request_target:
-        types: [opened, reopened, synchronize, ready_for_review]
-
-permissions:
-    contents: read
-    pull-requests: write
-
-# Collapse a burst of pushes to one run per PR; the latest state always wins.
-concurrency:
-    group: member-auto-merge-${{ github.event.pull_request.number }}
-    cancel-in-progress: true
-
-jobs:
-    enable:
-        # Pre-filter at workflow level so this doesn't spin up for every PR.
-        # The action repeats these checks for defense in depth (and clearer
-        # skip-reason logging), so trimming this `if` is fine; widening it
-        # is fine too — the action will skip anything that doesn't match.
-        if: |
-            github.event.pull_request.draft == false &&
-            (
-                github.event.pull_request.author_association == 'MEMBER' ||
-                github.event.pull_request.author_association == 'OWNER' ||
-                github.event.pull_request.author_association == 'COLLABORATOR'
-            ) &&
-            (
-                github.event.pull_request.base.ref == 'next' ||
-                github.event.pull_request.base.ref == 'hotfixes'
-            )
-        uses: CLDMV/.github/.github/workflows/reusable-member-auto-merge.yml@v4
-        with:
-            merge_method: "MERGE"
-            # CUSTOMIZE: tighten or widen as your repo requires.
-            # allowed_associations: "MEMBER,OWNER,COLLABORATOR"
-            # branch_prefixes: "feat,feature,fix,hotfix,chore,refactor,docs,ci,perf,test,style"
-        secrets:
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/next-release.yml

@@ -1,76 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/next-release.yml
-#	@Date: 2026-05-22T00:00:00-07:00 (1779433200)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/next-release.yml
-#
-# v4 core: maintain the ONE persistent `next → master` release PR for this repo.
-#
-# Fires on every push to `next` (contributor PR squash-merges land here).
-# Resolves the existing release PR and refreshes it, or creates it the first
-# time `next` diverges from master. The release PR batches all accumulated
-# feature commits into a single release — that batching is v4's whole point
-# (see CLDMV/.github docs/conventions/release-flow-v4.md §5.3, §6.1).
-#
-# Thin caller: all job logic (plan / create / refresh) lives in the reusable,
-# pinned at @v4. Bumping the pin carries fixes without editing this file.
-# CUSTOMIZE:
-#   - `package_name`  → your npm package (or any unique identifier)
-#   - `build_command` → your build script, or a stub like
-#                       `echo '✓ no build step'` for a meta package (optional;
-#                       defaults to `npm run build:ci`)
-name: 🚀 Next Release (v4)
-
-on:
-    push:
-        branches: [next]
-    workflow_dispatch: # manual kick — e.g. to open/refresh the PR for content already on `next`
-
-# Serialize: each run re-resolves the current PR state, so queueing (not
-# cancelling) avoids a create/refresh race when pushes land back-to-back.
-concurrency:
-    group: next-release-${{ github.repository }}
-    cancel-in-progress: false
-
-permissions:
-    contents: read
-
-jobs:
-    release:
-        permissions:
-            contents: write
-            pull-requests: write
-        uses: CLDMV/.github/.github/workflows/workflow-next-release.yml@v4
-        with:
-            package_name: "@cldmv/gh-broker"
-            build_command: "npm run build:ci"
-        secrets:
-            # Map your repo/org secrets to the expected names.
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
-            # Optional: only needed if you also use reusable-lint-format.yml /
-            # reusable-coverage-badge.yml (or otherwise sign a commit locally as
-            # this identity). Passed through so the release-PR changelog
-            # recognizes that identity as a bot instead of listing it as a
-            # contributor — see CLDMV_BOT_NAME/CLDMV_BOT_EMAIL in your other
-            # workflows for the same values.
-            BOT_NAME: ${{ secrets.CLDMV_BOT_NAME }}
-            BOT_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}
-            # Optional release-PR notifier webhooks — each is independently
-            # opt-in: leave one unset and that channel is silently skipped.
-            # Delete the lines you don't use.
-            DISCORD_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PUBLIC_WEBHOOK }}
-            DISCORD_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.DISCORD_RELEASE_PR_PRIVATE_WEBHOOK }}
-            SLACK_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PUBLIC_WEBHOOK }}
-            SLACK_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.SLACK_RELEASE_PR_PRIVATE_WEBHOOK }}
-            GENERIC_RELEASE_PR_PUBLIC_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PUBLIC_WEBHOOK }}
-            GENERIC_RELEASE_PR_PRIVATE_WEBHOOK: ${{ secrets.GENERIC_RELEASE_PR_PRIVATE_WEBHOOK }}

package/.github/workflows/next-reset.yml

@@ -1,50 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/next-reset.yml
-#	@Date: 2026-05-22T00:00:00-07:00 (1779433200)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/next-reset.yml
-#
-# v4 core: after a release lands on master, re-sync the integration branches
-# (CLDMV/.github docs/conventions/release-flow-v4.md §6.3, §7).
-#
-#   - `hotfixes` is ALWAYS force-reset to master HEAD after any release.
-#   - `next` depends on which lane released:
-#       * normal release (next → master, or a v3-style feat → master):
-#         force-reset `next` to master HEAD (§7.1).
-#       * hotfix release (hotfixes → master): MERGE master into `next` instead,
-#         so next's accumulated feature work is preserved (§7.2, option B).
-#
-# Thin caller: all job logic (the wait-for-tags gate + the branch sync) lives in
-# the reusable, pinned at @v4. Bumping the pin carries fixes without editing
-# this file.
-name: ♻️ Next/Hotfixes Reset (v4)
-
-on:
-    push:
-        branches: [master, main]
-
-concurrency:
-    group: next-reset-${{ github.repository }}
-    cancel-in-progress: false
-
-permissions:
-    contents: read
-
-jobs:
-    sync:
-        permissions:
-            contents: write
-        uses: CLDMV/.github/.github/workflows/workflow-next-reset.yml@v4
-        secrets:
-            # Map your repo/org secrets to the expected names.
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}