@mokoconsulting/mcp-mokosuite 1.0.0 → 1.1.0-dev.372

package/.mokogit/workflows/cascade-dev.yml

@@ -7,27 +7,20 @@
 # INGROUP: MokoCLI.Cascade
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogit/workflows/cascade-dev.yml
-# VERSION: 02.01.00
-# BRIEF: Cascade main -> dev; auto-merge clean, auto-resolve VERSION-stamp-only conflicts, else notify
+# VERSION: 02.04.00
+# BRIEF: Cascade main -> dev; branch-motivated (no schedule); skips dev-only repos (no main); auto-merge clean, auto-resolve routine conflicts INLINE (manifest version / .mokogit-.gitea-.github / docs-stamps) with no mokocli dependency, fall back to cascade_resolve.php then notify
 
 name: "Cascade Main -> Dev"
 
 on:
+  # Branch-motivated (no time-based schedule): any real push to main cascades to
+  # dev immediately. Sync commits from workflow_sync.php carry [skip ci] and are
+  # skipped by the platform (they fire no trigger at all), so workflow_sync.php
+  # dispatches this workflow directly (workflow_dispatch) after it changes a repo
+  # — that is what carries .mokogit drift down to dev, replacing the old daily cron.
   push:
     branches:
       - main
-    # A sync-only push to main (workflow/CI-config files) should not immediately
-    # cascade to dev and light up the release pipeline. The daily schedule below
-    # still carries the .mokogit drift down to dev.
-    paths-ignore:
-      - '.mokogit/**'
-      - '.gitea/**'
-      - '.github/**'
-  # Daily safety net: catches drift even when main only received [skip ci] pushes
-  # (which never fire the push trigger above), and .mokogit-only syncs ignored above.
-  # Off-round minute to avoid a fleet-wide spike.
-  schedule:
-    - cron: '23 7 * * *'
   workflow_dispatch:
 
 permissions:
@@ -51,10 +44,11 @@ jobs:
           fetch-depth: 0
           token: ${{ github.token }}
 
-      - name: Cascade main -> dev (auto-resolve version stamps, else notify)
+      - name: Cascade main -> dev (auto-resolve routine conflicts, else notify)
         env:
           TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
         run: |
           set -uo pipefail
           API="${MOKOGIT_URL}/api/v1/repos/${REPO}"
@@ -66,6 +60,13 @@ jobs:
             echo "No dev branch - nothing to cascade."; exit 0
           fi
 
+          # 0b. main must exist too. A dev-only repo (no main branch) has nothing to
+          # cascade FROM, so skip immediately instead of spinning up on the daily
+          # schedule / manual dispatch and no-op'ing later via a failed compare.
+          if ! curl -sf -H "$AUTH" "${API}/branches/main" >/dev/null 2>&1; then
+            echo "No main branch (dev-only repo) - nothing to cascade."; exit 0
+          fi
+
           # 1. is main ahead of dev?
           AHEAD=$(curl -sf -H "$AUTH" "${API}/compare/dev...main" \
             | python3 -c "import sys,json; print(json.load(sys.stdin).get('total_commits',0))" 2>/dev/null || echo 0)
@@ -139,60 +140,127 @@ jobs:
           CONFLICTS=$(git diff --name-only --diff-filter=U)
           echo "Conflicted files:"; echo "${CONFLICTS}"
 
-          # A conflict is "stamp-only" when every line inside every conflict block matches
-          # a version-stamp pattern (VERSION: header, <version> element, or CHANGELOG title).
-          is_stamp_only() {
-            awk '
-              /^<<<<<<< /   { inc=1; next }
-              inc && /^=======$/ { next }
-              /^>>>>>>> /   { inc=0; next }
-              inc { if ($0 !~ /(VERSION:|<version>|# Changelog)/) { bad=1 } }
-              END { exit(bad ? 1 : 0) }
-            ' "$1"
-          }
-          # Resolve a stamp-only file by keeping dev (ours) for the conflicting lines,
-          # preserving all auto-merged content around them.
-          keep_ours() {
-            awk '
-              /^<<<<<<< /   { inc=1; side="ours"; next }
-              inc && /^=======$/ { side="theirs"; next }
-              /^>>>>>>> /   { inc=0; next }
-              { if (!inc) { print; next } if (side=="ours") print }
-            ' "$1" > "$1.resolved" && mv "$1.resolved" "$1"
+          # --- Inline resolver (pure bash/git, NO mokocli dependency) -------------
+          # The common cascade churn is routine and deterministic, so resolve it here
+          # BEFORE reaching for cascade_resolve.php. This is what keeps the version
+          # ladder moving even when mokocli is unreachable on an ephemeral runner
+          # (the failure mode this workflow was hardened against): a pure
+          # version-stamp conflict must never stall dev behind main.
+          #
+          #   * manifest <version> conflicts (*.xml containing <extension) ->
+          #       version = max(dev, main) via `sort -V`, rewriting the tag while
+          #       preserving the file's own indentation (repos MIX tab and 2-space).
+          #   * .mokogit/** .gitea/** .github/** -> take main/canonical (--theirs).
+          #   * docs / CHANGELOG / stamp files    -> keep dev            (--ours).
+          # Anything still conflicted afterwards falls through to cascade_resolve.php
+          # (if available) and finally to a human, exactly as before.
+          resolve_manifest_version() {
+            # $1 = path to a conflicted *.xml manifest. Resolves ONLY the <version>
+            # conflict to max(dev,main); returns 0 if fully resolved, 1 otherwise.
+            local f="$1"
+            # Bail if the conflict touches anything other than a single <version> line
+            # on each side (i.e. a real content conflict, not just the stamp).
+            local nonver
+            nonver=$(awk '
+              /^<<<<<<< /{c=1;next} /^=======$/{c=2;next} /^>>>>>>> /{c=0;next}
+              (c==1||c==2) && $0 !~ /<version>[^<]*<\/version>/ {print "X"}
+            ' "$f")
+            [ -n "$nonver" ] && return 1
+            # Collect the version value from each side of every conflict hunk.
+            local ours theirs maxv
+            ours=$(awk '
+              /^<<<<<<< /{c=1;next} /^=======$/{c=2;next} /^>>>>>>> /{c=0;next}
+              c==1' "$f" | sed -n 's/.*<version>\([^<]*\)<\/version>.*/\1/p' | head -n1)
+            theirs=$(awk '
+              /^<<<<<<< /{c=1;next} /^=======$/{c=2;next} /^>>>>>>> /{c=0;next}
+              c==2' "$f" | sed -n 's/.*<version>\([^<]*\)<\/version>.*/\1/p' | head -n1)
+            [ -z "$ours" ] && [ -z "$theirs" ] && return 1
+            maxv=$(printf '%s\n%s\n' "$ours" "$theirs" | grep -v '^$' | sort -V | tail -n1)
+            [ -z "$maxv" ] && return 1
+            # Rewrite: drop conflict markers, keep OUR side's <version> line but with
+            # the max value substituted (preserves this file's leading indentation,
+            # tab or spaces). Drop the theirs-side version line.
+            awk -v maxv="$maxv" '
+              /^<<<<<<< /{c=1;next}
+              /^=======$/{c=2;next}
+              /^>>>>>>> /{c=0;next}
+              {
+                if (c==2) next
+                if (($0 ~ /<version>[^<]*<\/version>/) && (c==1)) {
+                  sub(/<version>[^<]*<\/version>/, "<version>" maxv "</version>")
+                }
+                print
+              }' "$f" > "${f}.resolved" && mv "${f}.resolved" "$f"
+            # Fully resolved only if no markers remain.
+            ! grep -qE '^(<<<<<<< |=======$|>>>>>>> )' "$f"
           }
 
-          ALL_STAMP=1
           for f in ${CONFLICTS}; do
-            if ! is_stamp_only "$f"; then
-              echo "::notice::$f has non-stamp conflicts -> manual resolution required."
-              ALL_STAMP=0; break
-            fi
+            case "$f" in
+              .mokogit/*|.gitea/*|.github/*)
+                git checkout --theirs -- "$f" && git add -- "$f" \
+                  && echo "resolved (theirs/main): $f" ;;
+              *CHANGELOG*|*/docs/*|docs/*|*.md|*VERSION*|*.stamp)
+                git checkout --ours -- "$f" && git add -- "$f" \
+                  && echo "resolved (ours/dev): $f" ;;
+              *.xml)
+                if grep -q '<extension' "$f" 2>/dev/null && resolve_manifest_version "$f"; then
+                  git add -- "$f"; echo "resolved (manifest version=max): $f"
+                else
+                  echo "unresolved (xml, not a simple version stamp): $f"
+                fi ;;
+              *)
+                echo "unresolved (needs deeper resolver): $f" ;;
+            esac
           done
 
-          if [ "$ALL_STAMP" != "1" ]; then
-            git merge --abort || true
-            notify "has non-version-stamp conflicts and cannot be auto-resolved."
+          # If the inline pass cleared every conflict, commit + push and we are done —
+          # no mokocli needed.
+          if [ -z "$(git diff --name-only --diff-filter=U)" ]; then
+            git commit -m "chore(sync): cascade main -> dev (auto-resolved inline) [skip ci]" >/dev/null
+            git push origin dev
+            echo "Cascade auto-resolved inline (no mokocli) and pushed to dev."
+            curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/issues/${PR}/comments" \
+              -d '{"body":"Cascade auto-resolved inline (manifest version=max(dev,main), .mokogit/.gitea/.github -> main, docs/stamps -> dev) with no mokocli dependency, and pushed to dev. Closing."}' >/dev/null || true
+            curl -s -H "$AUTH" -H "Content-Type: application/json" -X PATCH "${API}/pulls/${PR}" \
+              -d '{"state":"closed"}' >/dev/null || true
             exit 0
           fi
 
-          echo "All conflicts are VERSION-stamp-only; resolving in favour of dev."
-          for f in ${CONFLICTS}; do
-            keep_ours "$f"
-            git add "$f"
-          done
+          echo "Inline pass left conflicts; falling back to cascade_resolve.php..."
+          echo "Still conflicted:"; git diff --name-only --diff-filter=U
 
-          # Best-effort: normalise stamps to dev's version if mokocli is available.
-          if [ -f /opt/mokocli/cli/version_check.php ]; then
-            php /opt/mokocli/cli/version_check.php --fix || true
-            git add -A
+          # --- Fallback: cascade_resolve.php (existing behaviour) -----------------
+          # Handles the messier cases (modify/delete, plugin renames, etc.). It BAILS
+          # (exit 2) on real code conflicts, so those still get a human. ubuntu-latest
+          # has no /opt/mokocli, so clone mokocli on demand.
+          RESOLVER=/opt/mokocli/cli/cascade_resolve.php
+          if [ ! -f "$RESOLVER" ]; then
+            if git clone --depth 1 --quiet \
+                 "https://x-access-token:${MOKOGIT_TOKEN}@${MOKOGIT_URL#https://}/MokoConsulting/mokocli.git" \
+                 /tmp/mokocli 2>/dev/null \
+               || git clone --depth 1 --quiet "${MOKOGIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli 2>/dev/null; then
+              RESOLVER=/tmp/mokocli/cli/cascade_resolve.php
+            else
+              # Do NOT swallow this silently: a degraded run must be visible so the
+              # operator knows the fallback resolver was unavailable.
+              echo "::warning::On-demand mokocli clone failed; cascade_resolve.php is UNAVAILABLE. Inline resolver handled the routine classes; any remaining conflicts need a human."
+              RESOLVER=/tmp/mokocli/cli/cascade_resolve.php
+            fi
           fi
 
-          git commit -m "chore(sync): cascade main -> dev (auto-resolved version stamps) [skip ci]" >/dev/null
-          git push origin dev
-          echo "Cascade auto-resolved and pushed to dev."
+          if [ -f "$RESOLVER" ] && php "$RESOLVER" --path . --theirs-ref origin/main; then
+            git commit -m "chore(sync): cascade main -> dev (auto-resolved) [skip ci]" >/dev/null
+            git push origin dev
+            echo "Cascade auto-resolved and pushed to dev."
+            curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/issues/${PR}/comments" \
+              -d '{"body":"cascade_resolve auto-resolved the merge (manifests/workflows/docs/stamps, modify-delete) and pushed to dev. Closing."}' >/dev/null || true
+            curl -s -H "$AUTH" -H "Content-Type: application/json" -X PATCH "${API}/pulls/${PR}" \
+              -d '{"state":"closed"}' >/dev/null || true
+            exit 0
+          fi
 
-          # Close the now-redundant PR (its changes are in dev) with an explanatory comment.
-          curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/issues/${PR}/comments" \
-            -d '{"body":"Auto-resolved VERSION-stamp-only conflicts and pushed the merge to dev. Closing."}' >/dev/null || true
-          curl -s -H "$AUTH" -H "Content-Type: application/json" -X PATCH "${API}/pulls/${PR}" \
-            -d '{"state":"closed"}' >/dev/null || true
+          # Resolver unavailable, or it bailed on a real (code) conflict -> human.
+          git merge --abort || true
+          notify "has code conflicts cascade_resolve could not safely auto-resolve."
+          exit 0

package/.mokogit/workflows/changelog-validation.yml

@@ -9,7 +9,7 @@
 # INGROUP: MokoStandards.CI
 # REPO: https://github.com/mokoconsulting-tech/MokoStandards
 # PATH: /templates/workflows/shared/changelog-validation.yml.template
-# VERSION: 04.06.00
+# VERSION: 04.06.01
 # BRIEF: Validates CHANGELOG.md format and version consistency
 # NOTE: Deployed to .mokogit/workflows/changelog-validation.yml in governed repos.
 
@@ -30,6 +30,11 @@ permissions:
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
+concurrency:
+  # storm-reduction: collapse superseded validation runs on the same ref
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
 jobs:
   validate-changelog:
     name: Validate CHANGELOG.md
@@ -41,61 +46,72 @@ jobs:
 
       - name: Check CHANGELOG.md exists
         run: |
-          echo "### Changelog Validation" >> $GITHUB_STEP_SUMMARY
+          echo "### Changelog Validation" | tee -a $GITHUB_STEP_SUMMARY
           if [ ! -f "CHANGELOG.md" ]; then
-            echo "CHANGELOG.md not found in repository root." >> $GITHUB_STEP_SUMMARY
+            echo "CHANGELOG.md not found in repository root." | tee -a $GITHUB_STEP_SUMMARY
             exit 1
           fi
-          echo "CHANGELOG.md exists." >> $GITHUB_STEP_SUMMARY
+          echo "CHANGELOG.md exists." | tee -a $GITHUB_STEP_SUMMARY
 
-      - name: Check VERSION header matches README.md
+      - name: Check VERSION header matches README.md (only if README declares one)
         run: |
-          # Extract version from README.md FILE INFORMATION block
-          README_VERSION=$(grep -oP '^\s*VERSION:\s*\K[0-9]{2}\.[0-9]{2}\.[0-9]{2}' README.md | head -1)
+          # A FILE INFORMATION VERSION block is optional in README.md — public-facing
+          # READMEs typically have none. Only enforce a CHANGELOG match when README
+          # actually declares a version; otherwise skip (not a failure).
+          # `|| true`: under the default `bash -e -o pipefail`, a grep with no match
+          # exits 1 and pipefail propagates it, which would abort the step BEFORE the
+          # `-z` skip below — the exact common case (README with no VERSION block). Keep
+          # the empty result non-fatal so the intended skip path stays reachable.
+          README_VERSION=$(grep -oP '^\s*VERSION:\s*\K[0-9]+\.[0-9]+\.[0-9]+' README.md 2>/dev/null | head -1 || true)
           if [ -z "$README_VERSION" ]; then
-            echo "No VERSION found in README.md FILE INFORMATION block." >> $GITHUB_STEP_SUMMARY
-            exit 1
+            echo "README.md has no FILE INFORMATION VERSION block — skipping version-match check." | tee -a $GITHUB_STEP_SUMMARY
+            exit 0
           fi
 
-          # Check that CHANGELOG.md has a matching version header
-          CHANGELOG_VERSION=$(grep -oP '^\#\#\s*\[\K[0-9]{2}\.[0-9]{2}\.[0-9]{2}' CHANGELOG.md | head -1)
+          CHANGELOG_VERSION=$(grep -oP '^\#\#\s*\[\K[0-9]+\.[0-9]+\.[0-9]+' CHANGELOG.md | head -1 || true)
           if [ -z "$CHANGELOG_VERSION" ]; then
-            echo "No version header found in CHANGELOG.md (expected \`## [XX.YY.ZZ] - YYYY-MM-DD\`)." >> $GITHUB_STEP_SUMMARY
+            echo "README declares VERSION \`${README_VERSION}\` but CHANGELOG.md has no matching \`## [X.Y.Z]\` header." | tee -a $GITHUB_STEP_SUMMARY
             exit 1
           fi
 
           if [ "$CHANGELOG_VERSION" != "$README_VERSION" ]; then
-            echo "CHANGELOG latest version \`${CHANGELOG_VERSION}\` does not match README VERSION \`${README_VERSION}\`." >> $GITHUB_STEP_SUMMARY
+            echo "CHANGELOG latest version \`${CHANGELOG_VERSION}\` does not match README VERSION \`${README_VERSION}\`." | tee -a $GITHUB_STEP_SUMMARY
             exit 1
           fi
 
-          echo "CHANGELOG version \`${CHANGELOG_VERSION}\` matches README VERSION." >> $GITHUB_STEP_SUMMARY
+          echo "CHANGELOG version \`${CHANGELOG_VERSION}\` matches README VERSION." | tee -a $GITHUB_STEP_SUMMARY
 
       - name: Validate conventional changelog format
         run: |
           ERRORS=0
 
-          # Check that version entries follow ## [XX.YY.ZZ] - YYYY-MM-DD format
+          # Validate the format of each version entry. `## [Unreleased]` is a valid
+          # Keep-a-Changelog section (not a dated version) and is skipped.
           while IFS= read -r LINE; do
-            if ! echo "$LINE" | grep -qP '^\#\#\s*\[[0-9]{2}\.[0-9]{2}\.[0-9]{2}\]\s*-\s*[0-9]{4}-[0-9]{2}-[0-9]{2}'; then
-              echo "Malformed version header: \`${LINE}\`" >> $GITHUB_STEP_SUMMARY
-              echo "  Expected format: \`## [XX.YY.ZZ] - YYYY-MM-DD\`" >> $GITHUB_STEP_SUMMARY
+            if echo "$LINE" | grep -qiE '^\#\#[[:space:]]*\[unreleased\]'; then
+              continue
+            fi
+            if ! echo "$LINE" | grep -qP '^\#\#\s*\[[0-9]+\.[0-9]+\.[0-9]+\]\s*[-–—]+\s*[0-9]{4}-[0-9]{2}-[0-9]{2}'; then
+              echo "Malformed version header: \`${LINE}\`" | tee -a $GITHUB_STEP_SUMMARY
+              echo "  Expected format: \`## [X.Y.Z] --- YYYY-MM-DD\` (any hyphen/dash separator)" | tee -a $GITHUB_STEP_SUMMARY
               ERRORS=$((ERRORS + 1))
             fi
           done < <(grep -P '^\#\#\s*\[' CHANGELOG.md)
 
-          ENTRY_COUNT=$(grep -cP '^\#\#\s*\[' CHANGELOG.md || echo "0")
-          if [ "$ENTRY_COUNT" -eq 0 ]; then
-            echo "No version entries found in CHANGELOG.md." >> $GITHUB_STEP_SUMMARY
+          # Count real (dated) version entries, excluding the Unreleased section.
+          VERSION_COUNT=$(grep -P '^\#\#\s*\[' CHANGELOG.md | { grep -viE '\[unreleased\]' || true; } | wc -l | tr -d ' ')
+          HAS_UNRELEASED=$(grep -ciE '^\#\#[[:space:]]*\[unreleased\]' CHANGELOG.md | tr -d ' ')
+          if [ "$VERSION_COUNT" -eq 0 ] && [ "$HAS_UNRELEASED" -eq 0 ]; then
+            echo "No version entries or Unreleased section found in CHANGELOG.md." | tee -a $GITHUB_STEP_SUMMARY
             ERRORS=$((ERRORS + 1))
           else
-            echo "Found ${ENTRY_COUNT} version entr(ies) in CHANGELOG.md." >> $GITHUB_STEP_SUMMARY
+            echo "Found ${VERSION_COUNT} released version entr(ies)$([ "$HAS_UNRELEASED" -gt 0 ] && echo ' + an Unreleased section') in CHANGELOG.md." | tee -a $GITHUB_STEP_SUMMARY
           fi
 
-          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "" | tee -a $GITHUB_STEP_SUMMARY
           if [ "${ERRORS}" -gt 0 ]; then
-            echo "**${ERRORS} format issue(s) found.**" >> $GITHUB_STEP_SUMMARY
+            echo "**${ERRORS} format issue(s) found.**" | tee -a $GITHUB_STEP_SUMMARY
             exit 1
           else
-            echo "**Changelog format validation passed.**" >> $GITHUB_STEP_SUMMARY
+            echo "**Changelog format validation passed.**" | tee -a $GITHUB_STEP_SUMMARY
           fi

package/.mokogit/workflows/ci-issue-reporter.yml

@@ -53,7 +53,7 @@ jobs:
           MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
         run: |
           git clone --depth 1 --filter=blob:none --sparse "${MOKOGIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
-          cd /tmp/mokocli && git sparse-checkout set cli/ci_issue_reporter.sh
+          cd /tmp/mokocli && git sparse-checkout set cli
 
       - name: Report CI failure
         env:

package/.mokogit/workflows/cleanup.yml

@@ -33,11 +33,11 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.MOKOGIT_TOKEN }}
+          token: ${{ secrets.MOKOGIT_TOKEN || github.token }}
 
       - name: Delete merged branches
         env:
-          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
         run: |
           echo "=== Merged Branch Cleanup ==="
           API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"
@@ -66,7 +66,7 @@ jobs:
 
       - name: Clean old workflow runs
         env:
-          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
         run: |
           echo "=== Workflow Run Cleanup ==="
           API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"

package/.mokogit/workflows/custom-workflow-sync-trigger.yml

@@ -0,0 +1,83 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# PATH: /.mokogit/workflows/workflow-sync-trigger.yml
+# VERSION: 01.01.01
+# BRIEF: Trigger workflow sync to live repos when a PR is merged to main
+
+name: "Universal: Workflow Sync Trigger"
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [closed]
+    branches:
+      - main
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  sync:
+    name: Sync workflows to live repos
+    runs-on: release
+    if: >-
+      startsWith(github.event.repository.name, 'Template-') &&
+      (github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+      !contains(github.event.pull_request.title, '[skip sync]')))
+
+    steps:
+      - name: Determine platform from repo name
+        id: platform
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          case "$REPO" in
+            Template-Joomla)   PLATFORM="joomla" ;;
+            Template-Dolibarr) PLATFORM="dolibarr" ;;
+            Template-Go)       PLATFORM="go" ;;
+            Template-NPM)      PLATFORM="npm" ;;
+            Template-Generic)  PLATFORM="" ;;
+            *)                 PLATFORM="" ;;
+          esac
+          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+          echo "Platform: ${PLATFORM:-all}"
+
+      - name: Clone MokoCLI
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+        run: |
+          MOKOGIT_URL="${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}"
+          git clone --depth 1 "${MOKOGIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
+
+      - name: Install PHP
+        run: |
+          if ! command -v php &> /dev/null; then
+            apt-get update -qq && apt-get install -y -qq php-cli php-json php-curl > /dev/null 2>&1
+          fi
+
+      - name: Install dependencies
+        run: |
+          cd /tmp/mokocli
+          composer install --no-dev --no-interaction --quiet 2>/dev/null || true
+
+      - name: Run workflow sync
+        env:
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+        run: |
+          ARGS="--token ${MOKOGIT_TOKEN}"
+          ARGS="${ARGS} --org ${{ vars.MOKOGIT_ORG || github.repository_owner }}"
+          ARGS="${ARGS} --phase repos"
+          ARGS="${ARGS} --delete-orphans"
+
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          if [ -n "$PLATFORM" ]; then
+            ARGS="${ARGS} --platform-filter ${PLATFORM}"
+          fi
+
+          php /tmp/mokocli/cli/workflow_sync.php ${ARGS}

package/.mokogit/workflows/issue-branch.yml

@@ -32,7 +32,7 @@ jobs:
         # injection via a crafted issue title). Pass everything through env so
         # the values arrive as ordinary shell variables that are not re-parsed.
         env:
-          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
           REPO: ${{ github.repository }}
           ISSUE_NUM: ${{ github.event.issue.number }}
           ISSUE_TITLE: ${{ github.event.issue.title }}