@cldmv/gh-broker 0.7.0 → 0.9.0

package/.github/workflows/pr-notify.yml

@@ -1,44 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/pr-notify.yml
-#	@Date: 2026-05-26T00:00:00-07:00 (1779778800)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/pr-notify.yml
-#
-# Fires once per PR open. Targets ALL PRs in the repo (including the release
-# PRs opened by the release-flow workflows) — exactly one notification per
-# PR-open event.
-#
-# Channels are addressed by secret name; no config file. Set the secret to
-# enable the channel, leave it unset to skip:
-#
-#   DISCORD_PR_PUBLIC_WEBHOOK   / DISCORD_PR_PRIVATE_WEBHOOK
-#   SLACK_PR_PUBLIC_WEBHOOK     / SLACK_PR_PRIVATE_WEBHOOK
-#   GENERIC_PR_PUBLIC_WEBHOOK   / GENERIC_PR_PRIVATE_WEBHOOK
-#
-# Visibility is determined automatically from the repo: GitHub `public` →
-# PUBLIC, `private` or `internal` → PRIVATE. Set the org-level secret in
-# CLDMV for the default URL; set a repo-level secret with the same name to
-# override (or to an empty string to mute that channel for this repo).
-name: 📥 PR Notify
-
-on:
-    pull_request:
-        types: [opened]
-
-permissions:
-    contents: read
-    pull-requests: read
-
-jobs:
-    notify:
-        uses: CLDMV/.github/.github/workflows/reusable-pr-notifier.yml@v4
-        secrets: inherit

package/.github/workflows/pr-title-normalizer.yml

@@ -1,52 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/pr-title-normalizer.yml
-#	@Date: 2026-05-22T00:00:00-07:00 (1779433200)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/pr-title-normalizer.yml
-#
-# Normalize contributor PR titles to Conventional Commits format, derived from
-# the highest-priority commit in the PR. The release flow expects this shape, so
-# a v4 repo wants this enabled. (Also backportable to v3 repos — the underlying
-# action shipped in v3.3.0; it owns all skip logic: bot authors, the
-# long-running release PRs, titles already starting with `release:`, and titles
-# that already conform.)
-#
-# Thin caller: all job logic lives in the reusable, pinned at @v4. Bumping the
-# pin carries fixes without editing this file.
-name: 🏷️ PR Title Normalizer
-
-# SECURITY NOTE: pull_request_target runs in the BASE repo's context with WRITE
-# permissions and access to secrets. SAFE — the reusable's path is API-only (it
-# never checks out or executes PR content). Triggers on opened + synchronize
-# only (NOT edited): a maintainer hand-editing the title must not kick off a
-# re-normalize loop.
-on:
-    pull_request_target:
-        types: [opened, synchronize]
-
-concurrency:
-    group: pr-title-normalizer-${{ github.event.pull_request.number }}
-    cancel-in-progress: true
-
-permissions:
-    contents: read
-
-jobs:
-    normalize:
-        permissions:
-            contents: read
-            pull-requests: write
-        uses: CLDMV/.github/.github/workflows/workflow-pr-title-normalizer.yml@v4
-        secrets:
-            # Map your repo/org secrets to the expected names.
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/provenance.yml

@@ -1,51 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/provenance.yml
-#	@Date: 2026-09-05T00:00:00-07:00 (1788591600)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# SLSA build provenance (.intoto.jsonl) for this repo's published releases.
-# Decoupled from the publish workflow on purpose (see reusable-provenance.yml):
-# the SLSA generator is a reusable-workflow call and cannot carry
-# `continue-on-error`, so running it here — on its own `release: published`
-# trigger — keeps a provenance failure from ever turning a release run red
-# (issue #268). It re-packs the SAME build artifact the publish run uploaded, so
-# the signed subjects are byte-identical to what was published.
-#
-# Prereq: the org's allowed actions/reusable-workflows policy must permit
-# slsa-framework/*.
-name: 🔏 SLSA Provenance
-
-on:
-    release:
-        types: [published]
-
-jobs:
-    provenance:
-        # Public, real releases only — SLSA provenance is recorded in the public
-        # Rekor transparency log. Skip drafts, prereleases, and private repos.
-        if: |
-            !github.event.repository.private &&
-            !github.event.release.draft &&
-            !github.event.release.prerelease
-        permissions:
-            actions: read # look up the publish run's build artifact
-            id-token: write # provenance signing (OIDC)
-            contents: write # upload the .intoto.jsonl release asset
-        uses: CLDMV/.github/.github/workflows/reusable-provenance.yml@v4
-        with:
-            tag: ${{ github.event.release.tag_name }}
-            # CUSTOMIZE: these MUST match your publish.yml so the re-packed
-            # tarballs are byte-identical to what was published.
-            package_name: "@cldmv/gh-broker"
-            node_version: "lts/*"
-            # Satellite packages (same value as publish.yml's extra_packages);
-            # empty disables. See docs/conventions/satellite-packages.md.
-            extra_packages: ""

package/.github/workflows/publish.yml

@@ -1,146 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/publish.yml
-#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/publish.yml
-name: 📦 Release and Publish
-
-on:
-    push:
-        branches: [master, main]
-        paths-ignore:
-            - "**.md"
-            - ".github/ISSUE_TEMPLATE/**"
-            - ".github/PULL_REQUEST_TEMPLATE/**"
-    workflow_dispatch:
-        inputs:
-            debug:
-                description: "Enable debug logging for troubleshooting"
-                type: boolean
-                required: false
-                default: false
-            dry_run:
-                description: "Dry run mode - validate everything but don't publish or create releases"
-                type: boolean
-                required: false
-                default: false
-            node_version:
-                description: "Node.js version to use (default: lts/*)"
-                type: string
-                required: false
-                default: "lts/*"
-            package_manager:
-                description: "Package manager (npm or yarn)"
-                type: string
-                required: false
-                default: "npm"
-            test_environment:
-                description: "Environment for tests (affects NODE_ENV and NODE_OPTIONS --conditions flag)"
-                type: string
-                required: false
-                default: "development"
-            version:
-                description: "Version to publish (auto-detected from package.json if not provided)"
-                type: string
-                required: false
-                default: ""
-            publish_to_npm:
-                description: "Publish to NPM registry"
-                type: boolean
-                required: false
-                default: true
-            publish_to_github_packages:
-                description: "Publish to GitHub Packages registry"
-                type: boolean
-                required: false
-                default: true
-            min_node_version:
-                description: "Minimum Node.js version for matrix testing (enables matrix when set; default: 22.12.0 — the floor vitest 5 actually runs on)"
-                type: string
-                required: false
-                default: "22.12.0"
-            max_node_major:
-                description: "Max Node.js major version for the test matrix. Leave blank (the default) to inherit the CLDMV/.github reusable workflow's default; set a value only to pin/override for a specific run."
-                type: string
-                required: false
-                default: ""
-            use_gpg:
-                description: "Enable GPG signing (if GPG secrets provided)"
-                type: boolean
-                required: false
-                default: false
-
-# NEVER cancel an in-flight publish — half-published versions are nasty to
-# clean up. Concurrent publishes for the same ref queue instead so they
-# serialize naturally.
-concurrency:
-    group: publish-${{ github.workflow }}-${{ github.ref }}
-    cancel-in-progress: false
-
-permissions:
-    contents: read
-
-jobs:
-    publish-package:
-        if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
-        permissions:
-            contents: write
-            packages: write
-            id-token: write
-        uses: CLDMV/.github/.github/workflows/workflow-publish.yml@v4
-        with:
-            package_name: "@cldmv/gh-broker" # Required: replace with your NPM package name
-            debug: ${{ github.event.inputs.debug == 'true' }}
-            dry_run: ${{ github.event.inputs.dry_run == 'true' }}
-            node_version: ${{ github.event.inputs.node_version || 'lts/*' }}
-            package_manager: ${{ github.event.inputs.package_manager || 'npm' }}
-            version: ${{ github.event.inputs.version || '' }}
-            publish_to_npm: ${{ github.event.inputs.publish_to_npm != 'false' }}
-            publish_to_github_packages: ${{ github.event.inputs.publish_to_github_packages != 'false' }}
-            publish_command: ""
-            github_packages_publish_command: ""
-            min_node_version: ${{ github.event.inputs.min_node_version || '22.12.0' }}
-            max_node_major: ${{ github.event.inputs.max_node_major || '' }} # blank ⇒ inherit the CLDMV/.github reusable default
-            test_command: "npm test" # Use defaults: NODE_ENV=development, NODE_OPTIONS=--conditions=development
-            # test_command: "NODE_OPTIONS='--conditions=slothlet-dev' npm test"  # Override NODE_OPTIONS only
-            # test_command: "NODE_ENV=test npm test"  # Override NODE_ENV only
-            # test_command: "NODE_ENV=test NODE_OPTIONS='--conditions=slothlet-dev' npm test"  # Override both
-            test_environment: ${{ github.event.inputs.test_environment || 'development' }} # Alternative to setting in test_command
-            build_command: "npm run build:ci"
-            # --- Satellite packages (optional) ----------------------------------------
-            # Publish extra packages carved from this build's output (e.g. locale JSON,
-            # generated types) at the SAME version/commit as the core, each with its own
-            # @scope/name@version tag + GitHub Release. Uncomment to opt in.
-            #   extra_packages: a JSON [{ name, dir }] array, OR a glob (single '*' in the
-            #   final path segment, e.g. "dist-packages/*"). Empty = disabled.
-            #   build_subpackages_command: runs after build_command to produce
-            #   dist-packages/<name>/ — omit if build_command already does the carve.
-            # First publish of each new @scope/name needs a one-time token publish +
-            # trusted-publisher setup. Full details + the contract:
-            # docs/conventions/satellite-packages.md
-            # extra_packages: "dist-packages/*"
-            # build_subpackages_command: "npm run build:subpackages"
-            # --------------------------------------------------------------------------
-            is_prerelease: false
-            release_source_only: false
-            create_documentation: true
-            skip_performance_tests: false
-            skip_matrix_tests: false
-            use_gpg: ${{ github.event.inputs.use_gpg == 'true' }}
-        secrets:
-            NPM_TOKEN: ${{ secrets.NPM_TOKEN }}
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
-            TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }}
-            TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}
-            GPG_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_GPG_PRIVATE_KEY }}
-            GPG_PASSPHRASE: ${{ secrets.CLDMV_BOT_GPG_PASSPHRASE }}

package/.github/workflows/release-merge.yml

@@ -1,104 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/release-merge.yml
-#	@Date: 2026-09-29T02:39:40+00:00 (1790649580)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/release-merge.yml
-#
-# v4 core (optional): squash-merge the persistent `next → master` release PR on
-# YOUR APPROVAL, via the REST merge API with the PR body as the commit message.
-#
-# Why not just click "Squash and merge"? The mobile Default path can land a
-# title-only commit (dropping the curated changelog + coverage), and the web/
-# mobile squash UI auto-appends its own `Co-authored-by:` list (not deduped, not
-# bot-stripped). An explicit-message API merge avoids both — the release commit
-# is exactly the curated PR body. It also merges only once EVERY check (required
-# AND non-required, e.g. the coverage badge and the release-PR body refresh) has
-# finished and passed, so the body it captures is never stale.
-#
-# How you use it: approve the release PR as you normally do. The merge fires when
-# CI is green — if you approve before CI finishes, it re-evaluates once CI
-# actually finishes and merges once the last check passes. Nothing auto-merges
-# without your approval.
-#
-# Re-evaluation uses `workflow_run`, not `check_suite` — GitHub does not send
-# `check_suite: completed` for a suite created by GitHub Actions itself, which
-# is every check your own ci.yml produces; it only fires for a suite created
-# by a third-party App. See CLDMV/.github#318: an approval given before CI
-# finished left a release PR stuck fully green with nothing re-firing the
-# merge check, because check_suite silently never fired for that case at all.
-# `workflow_run` is GitHub's documented replacement for exactly this pattern.
-#
-# IMPORTANT: the merge gate waits on EVERY check-run on the release PR's head
-# commit, from any workflow — so `workflows:` below must name every workflow in
-# your repo that puts a check on that commit, not just ci.yml. Only the one that
-# finishes LAST can see a fully green head; if it isn't listed, nothing re-fires
-# and the PR sits approved + green until you dispatch this workflow by hand.
-# CodeQL in particular routinely outlasts ci.yml (CLDMV/.github PR #322 stuck
-# exactly this way). The list below covers the standard v4 template set by their
-# template `name:`s — names are matched literally (not by filename), so fix any
-# you renamed, and add any extra PR-triggered workflow your repo has. Listing a
-# workflow your repo doesn't have is harmless. `branches:` limits re-fires to
-# runs on the integration branches, so feature-branch CI doesn't wake this up.
-#
-# Thin caller: all logic lives in the reusable, pinned at @v4.
-# NOTE: pull_request_review / workflow_run events run the copy of this file on
-# the DEFAULT branch, so it takes effect once it ships to master with a release.
-name: 🚦 Release Merge (v4)
-
-on:
-    pull_request_review:
-        types: [submitted] # your approval arms it
-    workflow_run: # re-evaluate as each check-producing workflow finishes — see #318
-        workflows: # ← must match your workflows' `name:`s — see IMPORTANT above
-            - "🧪 CI Tests & Build"
-            - "🔍 CodeQL"
-            - "🔒 Dependency Review"
-            - "📊 Bundle Size"
-            - "🚀 Next Release (v4)"
-            - "🚑 Hotfixes Release (v4)"
-            - "🌿 Branch Retention"
-            - "🏷️ PR Labeler"
-            - "🏷️ PR Title Normalizer"
-            - "👋 Welcome Contributor"
-            - "🔀 Hotfix PR Redirector (v4)"
-            - "🚀 Member Auto-Enable Auto-Merge"
-            - "🤖 Dependabot Auto-Merge"
-            - "🔁 Dependabot Auto-Recreate"
-            - "📜 CLA"
-            - "📥 PR Notify"
-        types: [completed]
-        branches: [next, hotfixes]
-    workflow_dispatch: # manual re-evaluation
-
-# Serialize per repo: each run re-resolves the release PR + re-gates the head,
-# so queue (don't cancel) to avoid racing a merge that's already in flight.
-# GitHub keeps one pending run per group and a newer arrival replaces it — that
-# is harmless, since every run re-reads approval + check state from the API.
-concurrency:
-    group: release-merge-${{ github.repository }}
-    cancel-in-progress: false
-
-permissions:
-    contents: read
-
-jobs:
-    merge:
-        permissions:
-            contents: write
-            pull-requests: write
-            checks: read
-            statuses: read
-        uses: CLDMV/.github/.github/workflows/workflow-release-merge.yml@v4
-        secrets:
-            # Map your repo/org secrets to the expected names.
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/release-notify.yml

@@ -1,41 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/release-notify.yml
-#	@Date: 2026-07-19T00:00:00-07:00 (1784444400)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/release-notify.yml
-#
-# Fires on `release: published` and dispatches the release announcement to
-# any enabled webhook. No config file — each channel is just a secret:
-#
-#   DISCORD_RELEASES_PUBLIC_WEBHOOK   / DISCORD_RELEASES_PRIVATE_WEBHOOK
-#   SLACK_RELEASES_PUBLIC_WEBHOOK     / SLACK_RELEASES_PRIVATE_WEBHOOK
-#   GENERIC_RELEASES_PUBLIC_WEBHOOK   / GENERIC_RELEASES_PRIVATE_WEBHOOK
-#
-# Visibility is determined automatically from the repo: GitHub `public` →
-# PUBLIC, `private` or `internal` → PRIVATE. Set the org-level secret in
-# CLDMV for the default URL; set a repo-level secret with the same name to
-# override (or to an empty string to mute that channel for this repo).
-name: 📣 Release Notify
-
-on:
-    release:
-        types: [published]
-
-permissions:
-    contents: read
-
-jobs:
-    notify:
-        # Defensive: skip untagged releases (mirrors Batch 1.2's filter)
-        if: github.event.release.tag_name != ''
-        uses: CLDMV/.github/.github/workflows/reusable-release-notifier.yml@v4
-        secrets: inherit

package/.github/workflows/scorecard.yml

@@ -1,64 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/scorecard.yml
-#	@Date: 2026-05-31T00:00:00-07:00 (1780210800)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/scorecard.yml
-#
-# OpenSSF Scorecard — scans the repo against ~18 security best-practice checks
-# and produces a 0-10 score. Thin caller: the steps and the SHA-pinned
-# scorecard-action version live in reusable-scorecard.yml@v4, so the action
-# version can't drift in this copy (it just calls the org reusable). Triggers
-# stay here, per OpenSSF's recommended setup.
-name: 🔬 OpenSSF Scorecard
-
-on:
-    branch_protection_rule:
-    schedule:
-        - cron: "32 7 * * 1" # weekly Monday 07:32 UTC
-    push:
-        branches: [master, main]
-    workflow_dispatch:
-
-# Caller must grant what the reusable needs — notably id-token: write for the
-# OpenSSF transparency-log publish.
-#
-# Keep the workflow-level grant READ-ONLY (contents: read) and grant every
-# WRITE on the `analyze` job instead. scorecard-action's publish step verifies that write permissions
-# were granted JOB-scoped, not workflow-wide (matching OSSF's own example:
-# https://github.com/ossf/scorecard-action#example-workflow). A workflow-level
-# grant satisfies GitHub's own reusable-workflow permission rules fine, but
-# still trips scorecard-action's own check — the rejection ("workflow
-# verification failed: global perm is set to write: permission for X is set
-# to write") means "granted globally," not "forbidden."
-#
-# Do NOT add security-events: write here while publish_results: true below.
-# scorecard-action's publish step rejects submissions from a workflow whose
-# token has security-events write access (it verifies the caller can't have
-# tampered with results before they hit the public transparency log). That
-# trade-off means the reusable's own SARIF-to-Security-tab upload step has no
-# permission to run in this configuration; the public OpenSSF badge is the
-# thing this default enables, so consumers take that trade-off by default.
-# Only add security-events: write back (job-scoped) if publish_results is set
-# to false instead (SARIF-to-Security-tab upload, no public badge).
-
-permissions:
-    contents: read
-
-jobs:
-    analyze:
-        permissions:
-            id-token: write
-            contents: read
-            actions: read
-        uses: CLDMV/.github/.github/workflows/reusable-scorecard.yml@v4
-        with:
-            publish_results: true # set false to skip the public badge in favor of SARIF-to-Security-tab. Private repos need not bother: every scorecard job auto-skips there (OpenSSF cannot publish private repos, so the run would only burn paid minutes).

package/.github/workflows/stale.yml

@@ -1,50 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/stale.yml
-#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/stale.yml
-#
-# First-run guidance: on a repo with an existing backlog, the first
-# scheduled run can mark a LOT of issues stale at once (notification storm).
-# Recommended: enable with `dry_run: true` first, dispatch manually to
-# preview, then flip to live. The dispatch input below makes this easy.
-#
-# Batch 2.3 from tmp/plan-future-workflows.md.
-name: 🍂 Stale Issues & PRs
-
-on:
-    schedule:
-        - cron: "13 5 * * *" # daily 05:13 UTC (off-the-hour to avoid GH cron stampede)
-    workflow_dispatch:
-        inputs:
-            dry_run:
-                description: "Preview only — no changes will be made"
-                type: boolean
-                default: false
-
-permissions:
-    issues: write
-    pull-requests: write
-
-jobs:
-    sweep:
-        uses: CLDMV/.github/.github/workflows/reusable-stale.yml@v4
-        with:
-            dry_run: ${{ github.event.inputs.dry_run == 'true' }}
-            # Override timers if needed:
-            # days_before_issue_stale: 60
-            # days_before_issue_close: 14
-            # days_before_pr_stale: 30
-            # days_before_pr_close: 7
-        secrets:
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

package/.github/workflows/tag-health.yml

@@ -1,70 +0,0 @@
-#
-#	@Project: @cldmv/gh-broker
-#	@Filename: /.github/workflows/tag-health.yml
-#	@Date: 2026-05-20T00:00:00-07:00 (1779260400)
-#	@Author: Nate Corcoran <CLDMV>
-#	@Email: <Shinrai@users.noreply.github.com>
-#	-----
-#	@Last modified by: Nate Corcoran <CLDMV> (Shinrai@users.noreply.github.com)
-#	@Last modified time: 2026-10-02T11:30:57-07:00 (1790965857)
-#	-----
-#	@Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
-#
-
-# Individual repo: .github/workflows/tag-health.yml
-#
-# Wakes the reusable-tag-health.yml workflow on a weekly schedule. The
-# reusable already implements validation, bot-signature fixes, unsigned-tag
-# fixes, orphaned-release recovery, orphaned-tag relocation, and rolling
-# major/minor tag maintenance — but it's dormant by default. This template
-# is what triggers it.
-#
-# Batch 3.1 from tmp/plan-future-workflows.md.
-name: 🏥 Tag Health
-
-on:
-    schedule:
-        # Weekly Sunday 04:04 UTC. Off-the-hour to dodge the GitHub :00-cron
-        # stampede; weekly cadence because tag drift accumulates slowly.
-        - cron: "4 4 * * 0"
-    workflow_dispatch:
-        inputs:
-            debug:
-                description: "Enable debug logging for troubleshooting"
-                type: boolean
-                required: false
-                default: false
-            create_documentation:
-                description: "Update VERSION_TAGS.md if rolling tags moved"
-                type: boolean
-                required: false
-                default: false
-            use_gpg:
-                description: "Enable GPG signing for any tags the sweep creates/recreates"
-                type: boolean
-                required: false
-                default: true
-
-permissions:
-    contents: read
-
-jobs:
-    health:
-        permissions:
-            contents: write
-        uses: CLDMV/.github/.github/workflows/reusable-tag-health.yml@v4
-        with:
-            debug: ${{ github.event.inputs.debug == 'true' }}
-            # Full unified sweep: validates, fixes bot signatures, fixes
-            # unsigned tags, recovers orphaned releases, relocates orphaned
-            # tags, and updates rolling major/minor refs.
-            run_unified_tag_health: true
-            create_documentation: ${{ github.event.inputs.create_documentation == 'true' }}
-            use_gpg: ${{ github.event.inputs.use_gpg != 'false' }}
-        secrets:
-            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
-            TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }}
-            TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}
-            GPG_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_GPG_PRIVATE_KEY }}
-            GPG_PASSPHRASE: ${{ secrets.CLDMV_BOT_GPG_PASSPHRASE }}