@mokoconsulting/mcp-mokosuite 1.0.0

package/.mokogit/workflows/pre-release.yml

@@ -0,0 +1,413 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Release
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogit/workflows/pre-release.yml
+# VERSION: 06.00.00
+# BRIEF: Batched pre-release on nightly schedule + manual dispatch (rolling dev/rc asset, build-metadata version — #404)
+
+name: "Universal: Pre-Release"
+
+# #404 — moved OFF every-push to a nightly schedule + manual dispatch. Building a
+# dev/rc pre-release on every push (and committing a version bump back) caused
+# manifest <version> merge conflicts and wasted CI builds + void versioned dev
+# assets. Batching to nightly removes most of that load; the version now advances
+# as BUILD METADATA (version_build_metadata.php) instead of a committed bump, and
+# the asset is published under a FIXED rolling name replaced in place.
+on:
+  schedule:
+    # Nightly at 07:00 UTC — batches the day's dev merges into one dev build.
+    - cron: '0 7 * * *'
+  workflow_dispatch:
+    inputs:
+      stability:
+        description: 'Pre-release channel'
+        required: true
+        default: development
+        type: choice
+        options:
+          - development
+          - alpha
+          - beta
+          - release-candidate
+      ref:
+        description: 'Branch to build (default: dev)'
+        required: false
+        default: dev
+        type: string
+
+permissions:
+  contents: write
+
+env:
+  GIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+  GIT_ORG: ${{ vars.MOKOGIT_ORG || github.repository_owner }}
+  GIT_REPO: ${{ vars.MOKOGIT_REPO || github.event.repository.name }}
+
+jobs:
+  build:
+    name: "Build Pre-Release (${{ inputs.stability || 'development' }})"
+    runs-on: release
+    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
+    # Trigger-loop guard (#404 follow-up): this workflow already runs ONLY on `schedule` +
+    # `workflow_dispatch` (the every-push trigger that caused the ~150x pre-release storm on
+    # chore/mokoonyx-template-sync-* branches was removed in #404) — so a template-sync push
+    # can no longer reach it. As defence-in-depth we also refuse a manual dispatch aimed at a
+    # bot/sync ref, so provisioning tooling cannot fan out dispatches against those branches.
+    if: >-
+      !startsWith(github.event.repository.name, 'Template-') &&
+      (
+        github.event_name == 'schedule' ||
+        (
+          github.event_name == 'workflow_dispatch' &&
+          !startsWith(inputs.ref, 'chore/') &&
+          !startsWith(inputs.ref, 'sync/') &&
+          !startsWith(inputs.ref, 'bot/') &&
+          !startsWith(inputs.ref, 'mokoonyx-template-sync') &&
+          !startsWith(inputs.ref, 'template-sync')
+        )
+      )
+
+    steps:
+      # #404 — no push event any more. The build ref is the dispatch input (default
+      # dev) or, for the nightly schedule, dev. On schedule github.ref_name is the
+      # default branch (main), so we resolve the pre-release branch explicitly here.
+      - name: Resolve build ref
+        id: ref
+        run: echo "ref=${{ inputs.ref || 'dev' }}" >> "$GITHUB_OUTPUT"
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+          token: ${{ secrets.MOKOGIT_TOKEN }}
+          ref: ${{ steps.ref.outputs.ref }}
+          submodules: recursive
+
+      - name: Update submodules to main
+        run: |
+          git submodule foreach --quiet 'git checkout main && git pull --quiet origin main' 2>/dev/null || true
+
+      - name: Setup MokoCLI tools
+        env:
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+        run: |
+          # Use pre-installed /opt/mokocli if available (updated by cron every 6h)
+          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/cli/manifest_element.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+            echo Using pre-installed /opt/mokocli
+            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+          else
+            echo Falling back to fresh clone
+            if ! command -v composer > /dev/null 2>&1; then
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            fi
+            rm -rf /tmp/mokocli
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+            cd /tmp/mokocli
+            # Authenticate to the MokoGIT private Composer registry (git.mokoconsulting.tech)
+            # declared in mokocli composer.json (preferred-install=dist) before installing deps.
+            composer config -g http-basic.git.mokoconsulting.tech x-access-token "${MOKO_CLONE_TOKEN}"
+            composer install --no-dev --no-interaction --no-progress --optimize-autoloader --quiet
+            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+          fi
+
+      - name: Detect platform
+        id: platform
+        run: |
+          # Authoritative source of truth (#122): the repo's org-customizable
+          # platform lives in the MokoGIT metadata API. Read it FIRST and, when
+          # present, emit it as the single `platform` output. This avoids the
+          # previous clobber where platform_detect.php + manifest_read.php both
+          # appended `platform=` under this same id (last-write-wins), and where
+          # manifest_read.php hit the removed /manifest route (404) and fell back
+          # to generic autodetect — misclassifying an mcp repo as nodejs and
+          # skipping the whole release.
+          PLATFORM=$(curl -sf \
+            -H "Authorization: token ${{ secrets.MOKOGIT_TOKEN }}" \
+            "${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}/metadata" \
+            | python3 -c "import json,sys; print((json.load(sys.stdin).get('platform') or '').strip())" 2>/dev/null || true)
+
+          if [ -n "$PLATFORM" ]; then
+            # Authoritative metadata wins — do NOT run the file-based detectors,
+            # so nothing can overwrite this value in $GITHUB_OUTPUT.
+            echo "platform=${PLATFORM}" >> "$GITHUB_OUTPUT"
+            echo "::notice::Platform '${PLATFORM}' from authoritative metadata API"
+          else
+            # Fallback (metadata empty/unreachable): retain the existing
+            # detection so repos without metadata still resolve a platform.
+            echo "::notice::No metadata.platform — falling back to file-based detection"
+            php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
+            php ${MOKO_CLI}/manifest_read.php --path . --github-output
+          fi
+
+      - name: Check platform eligibility
+        id: eligibility
+        run: |
+          # Shared release engine (#122): the pre-release path runs for every
+          # artifact platform that produces releases — joomla, npm, mcp, and client. Deploy-only platforms (go) are
+          # EXCLUDED: they consume a tag but never bump/release here.
+          #
+          # is_joomla_family selects the Joomla/PHP-specific steps (manifest
+          # element/zip resolution, release_package.php zip, updates.xml). Those
+          # steps stay TRUE for the Joomla family so Joomla behavior is unchanged,
+          # and are skipped for npm/mcp/client, which ride only the platform-
+          # agnostic steps (version, tag, changelog, release-notes, release,
+          # cascade). Build/publish stay in the platform shim (ADR #124).
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          IS_JOOMLA_FAMILY=false
+          # STEP 1 — Authoritative baseline (unchanged): the hardcoded case gate
+          # remains the source of truth for `proceed` and the default value of
+          # is_joomla_family. Everything below (the registry lookup) is PURELY
+          # ADDITIVE and can only *refine* is_joomla_family for a cleanly-matched
+          # platform — it never flips `proceed`, never downgrades, and any
+          # failure/absence leaves this decision exactly as it is today.
+          case "$PLATFORM" in
+            joomla*)
+              PROCEED=true
+              IS_JOOMLA_FAMILY=true
+              ;;
+            npm*|mcp*|client*)
+              PROCEED=true
+              ;;
+            *)
+              PROCEED=false
+              echo "::notice::Platform '$PLATFORM' — not an artifact release platform, skipping pre-release auto-bump"
+              ;;
+          esac
+
+          # STEP 2 — Registry enhancement (#125): classify the Joomla family from
+          # the live platform registry (GET /api/v1/platforms) so newly-registered
+          # manifest/packaging platforms get correct family classification without
+          # editing this workflow. We key on the registry `family` field: family
+          # `joomla` is exactly the Joomla-style manifest/packaging
+          # path (the manifest_element + release_package steps). We deliberately do
+          # NOT key on `manifest_based`, because npm and mcp are also
+          # manifest_based:true yet must ride the platform-agnostic path (family
+          # `node`) — so `manifest_based` is ambiguous here and `family` is the
+          # clean discriminator.
+          #
+          # Fail-safe contract: the curl is captured into a var (never allowed to
+          # crash the step under set -e -o pipefail), the JSON is parsed with a
+          # guarded python3 one-liner, and the result is only applied when it is
+          # exactly "true"/"false". On ANY of {non-200, curl error, empty/malformed
+          # JSON, parse failure, platform key absent} REGISTRY_FAMILY stays empty
+          # and we keep the STEP 1 hardcoded value untouched.
+          REGISTRY_JSON="$(curl -sf \
+            -H "Authorization: token ${{ secrets.MOKOGIT_TOKEN }}" \
+            "${GIT_URL}/api/v1/platforms" 2>/dev/null || true)"
+          REGISTRY_FAMILY=""
+          if [ -n "$REGISTRY_JSON" ]; then
+            # Single physical line of python3 so we stay safely inside this YAML
+            # block scalar (a column-0 continuation would terminate the scalar).
+            # Emits exactly: "true"  -> matched key, family joomla;
+            #                "false" -> matched key, some other family;
+            #                ""      -> key absent (fall back to hardcoded).
+            # On malformed/empty JSON the parse raises, 2>/dev/null hides the
+            # traceback and the trailing "|| true" keeps set -e -o pipefail from
+            # crashing the step, so REGISTRY_FAMILY stays "" and we fall back.
+            REGISTRY_FAMILY="$(printf '%s' "$REGISTRY_JSON" | PLATFORM="$PLATFORM" python3 -c 'import json,os,sys; p=os.environ.get("PLATFORM",""); f=next((x.get("family","") for x in json.load(sys.stdin) if x.get("key")==p), None); sys.stdout.write("true" if f == "joomla" else ("false" if f is not None else ""))' 2>/dev/null || true)"
+          fi
+          if [ "$REGISTRY_FAMILY" = "true" ]; then
+            IS_JOOMLA_FAMILY=true
+            echo "::notice::Registry classified '$PLATFORM' as Joomla family (via /api/v1/platforms)"
+          elif [ "$REGISTRY_FAMILY" = "false" ]; then
+            IS_JOOMLA_FAMILY=false
+            echo "::notice::Registry classified '$PLATFORM' as non-Joomla family (via /api/v1/platforms)"
+          else
+            echo "::notice::Registry lookup unavailable/absent for '$PLATFORM' — using hardcoded family classification"
+          fi
+
+          echo "proceed=${PROCEED}" >> "$GITHUB_OUTPUT"
+          echo "is_joomla_family=${IS_JOOMLA_FAMILY}" >> "$GITHUB_OUTPUT"
+          if [ "$PROCEED" = "true" ]; then
+            echo "::notice::Platform '$PLATFORM' eligible for pre-release (joomla_family=${IS_JOOMLA_FAMILY})"
+          fi
+
+      - name: Resolve metadata and bump version
+        id: meta
+        if: steps.eligibility.outputs.proceed == 'true'
+        run: |
+          # #404 — stability comes from the dispatch input; the nightly schedule
+          # always builds the development channel. There is no push event.
+          if [ "${{ github.event_name }}" = "schedule" ]; then
+            STABILITY="development"
+          else
+            STABILITY="${{ inputs.stability || 'development' }}"
+          fi
+
+          case "$STABILITY" in
+            development)        SUFFIX="-dev";   TAG="development" ;;
+            alpha)              SUFFIX="-alpha"; TAG="alpha" ;;
+            beta)               SUFFIX="-beta";  TAG="beta" ;;
+            release-candidate)  SUFFIX="-rc";    TAG="release-candidate" ;;
+          esac
+
+          # #404 — VERSION AS BUILD METADATA, NOT A COMMITTED BUMP.
+          # version_build_metadata.php derives a monotonic version from the CI run
+          # number and stamps it into the in-tree manifest ONLY (no git add/commit/
+          # push). This keeps <version> advancing so Joomla's updater still detects
+          # new dev/rc builds, while removing the pushed bump commit that caused
+          # manifest <version> merge conflicts on every branch->dev merge.
+          php ${MOKO_CLI}/version_build_metadata.php \
+            --path . --stability "$STABILITY" --github-output 2>/dev/null || true
+
+          # Read back the derived base (suffix stripped) and cascade into the
+          # platform-specific manifest files — still IN-TREE ONLY, never committed.
+          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "00.00.01")
+          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
+
+          php ${MOKO_CLI}/version_set_platform.php \
+            --path . --version "$VERSION" --branch "${{ steps.ref.outputs.ref }}" --stability "$STABILITY" 2>/dev/null || true
+          php ${MOKO_CLI}/version_check.php --path . --fix 2>/dev/null || true
+
+          # Ensure licensing tags (updateservers, dlid) if enabled in manifest.xml
+          php ${MOKO_CLI}/manifest_licensing.php --path . --fix 2>/dev/null || true
+
+          # Append suffix for output
+          if [ -n "$SUFFIX" ]; then
+            VERSION="${VERSION}${SUFFIX}"
+          fi
+
+          # NOTE: no commit/push here (#404). The derived version lives only in the
+          # built artifact + the dynamic updates feed; the branch tip is untouched.
+
+          # Auto-detect element via manifest_element.php (Joomla-family only:
+          # element/manifest resolution is Joomla-specific). For npm/mcp/client
+          # the generic fallback below derives ext_element/zip_name from the repo
+          # name — no Joomla manifest is present or required.
+          if [ "${{ steps.eligibility.outputs.is_joomla_family }}" = "true" ]; then
+            php ${MOKO_CLI}/manifest_element.php \
+              --path . --version "$VERSION" --stability "$STABILITY" \
+              --repo "${GIT_REPO}" --github-output
+          fi
+
+          # Read back element outputs
+          EXT_ELEMENT=$(grep '^ext_element=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2 || true)
+          ZIP_NAME=$(grep '^zip_name=' "$GITHUB_OUTPUT" | tail -1 | cut -d= -f2 || true)
+          [ -z "$EXT_ELEMENT" ] && EXT_ELEMENT=$(echo "${GIT_REPO}" | tr '[:upper:]' '[:lower:]' | tr -d ' -')
+          [ -z "$ZIP_NAME" ] && ZIP_NAME="${EXT_ELEMENT}-${VERSION}.zip"
+
+          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "stability=${STABILITY}" >> "$GITHUB_OUTPUT"
+          echo "suffix=${SUFFIX}" >> "$GITHUB_OUTPUT"
+          echo "tag=${TAG}" >> "$GITHUB_OUTPUT"
+          echo "zip_name=${ZIP_NAME}" >> "$GITHUB_OUTPUT"
+          echo "ext_element=${EXT_ELEMENT}" >> "$GITHUB_OUTPUT"
+
+          echo "=== Pre-Release: ${EXT_ELEMENT} ${VERSION}${SUFFIX} ==="
+
+      - name: Create release
+        id: release
+        if: steps.eligibility.outputs.proceed == 'true'
+        run: |
+          TAG="${{ steps.meta.outputs.tag }}"
+          VERSION="${{ steps.meta.outputs.version }}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          php ${MOKO_CLI}/release_create.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GIT_REPO}" --branch "${{ steps.ref.outputs.ref }}" --prerelease
+
+      - name: Update release notes from CHANGELOG.md
+        if: steps.eligibility.outputs.proceed == 'true'
+        run: |
+          TAG="${{ steps.meta.outputs.tag }}"
+          VERSION="${{ steps.meta.outputs.version }}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+
+          # Extract [Unreleased] section via the shared mokocli command (#364 centralization).
+          if [ -f "CHANGELOG.md" ]; then
+            NOTES=$(php ${MOKO_CLI}/release_notes.php --path . --version Unreleased 2>/dev/null || true)
+            # release_notes.php echoes "Release Unreleased" when the section is empty; normalize.
+            [ "$NOTES" = "Release Unreleased" ] && NOTES=""
+            [ -z "$NOTES" ] && NOTES="Release ${VERSION}"
+          else
+            NOTES="Release ${VERSION}"
+          fi
+
+          # Update release body via API
+          RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGIT_TOKEN }}" \
+            "${API_BASE}/releases/tags/${TAG}" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+
+          if [ -n "$RELEASE_ID" ]; then
+            python3 -c "
+          import json, urllib.request
+          body = open('/dev/stdin').read()
+          payload = json.dumps({'body': body}).encode()
+          req = urllib.request.Request(
+              '${API_BASE}/releases/${RELEASE_ID}',
+              data=payload, method='PATCH',
+              headers={
+                  'Authorization': 'token ${{ secrets.MOKOGIT_TOKEN }}',
+                  'Content-Type': 'application/json'
+              })
+          urllib.request.urlopen(req)
+          " <<< "$NOTES"
+            echo "Release notes updated from CHANGELOG.md"
+          fi
+
+      # Joomla-family only: mokocli release_package.php builds the extension zip
+      # (+ sha256, attach). npm/mcp/client package/publish in their platform shim
+      # (trust boundary, ADR #124), so this PHP zip step is skipped for them.
+      - name: Build package and upload
+        id: package
+        if: >-
+          steps.eligibility.outputs.proceed == 'true' &&
+          steps.eligibility.outputs.is_joomla_family == 'true'
+        run: |
+          VERSION="${{ steps.meta.outputs.version }}"
+          TAG="${{ steps.meta.outputs.tag }}"
+          STABILITY="${{ steps.meta.outputs.stability }}"
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          # #404 — publish the pre-release asset under a FIXED rolling name
+          # (pkg_<ext>-dev.zip / -rc.zip) replaced in place, instead of a new
+          # versioned file each build. --stability drives the channel slug; the
+          # in-package manifest <version> still advances (build metadata) so the
+          # updater keeps detecting new builds.
+          php ${MOKO_CLI}/release_package.php \
+            --path . --version "$VERSION" --tag "$TAG" \
+            --token "${{ secrets.MOKOGIT_TOKEN }}" --api-base "$API_BASE" \
+            --repo "${GIT_REPO}" --output /tmp \
+            --stability "$STABILITY" --rolling || true
+
+      # updates.xml is generated dynamically by MokoGIT license server.
+      # #404 — the dynamic feed must point <downloadurl> at the FIXED rolling asset
+      # name for dev/rc (pkg_<ext>-dev.zip), matching what release_package.php now
+      # publishes. mokocli's updates_xml_build.php grew a --rolling flag for this;
+      # the server-side generator (MokoGIT license server) needs the equivalent
+      # change so the served updates.xml references the fixed filename, not the old
+      # versioned one. See #404 report — flagged for human/server-side follow-up.
+
+      - name: "Delete lesser pre-release channels (cascade)"
+        if: steps.eligibility.outputs.proceed == 'true'
+        continue-on-error: true
+        run: |
+          API_BASE="${GIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ secrets.MOKOGIT_TOKEN }}"
+
+          php ${MOKO_CLI}/release_cascade.php \
+            --stability "${{ steps.meta.outputs.stability }}" \
+            --token "${TOKEN}" \
+            --api-base "${API_BASE}"
+
+      - name: Summary
+        if: always()
+        run: |
+          VERSION="${{ steps.meta.outputs.version }}"
+          STABILITY="${{ steps.meta.outputs.stability }}"
+          ZIP_NAME="${{ steps.meta.outputs.zip_name }}"
+          SHA256="${{ steps.package.outputs.sha256_zip }}"
+          echo "## Pre-Release Complete" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "| Field | Value |" >> $GITHUB_STEP_SUMMARY
+          echo "|-------|-------|" >> $GITHUB_STEP_SUMMARY
+          echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| Channel | ${STABILITY} |" >> $GITHUB_STEP_SUMMARY
+          echo "| Package | \`${ZIP_NAME}\` |" >> $GITHUB_STEP_SUMMARY
+          echo "| SHA-256 | \`${SHA256:-n/a}\` |" >> $GITHUB_STEP_SUMMARY

package/.mokogit/workflows/push-notify.yml

@@ -0,0 +1,43 @@
+# +========================================================================+
+# |  Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>         |
+# |  SPDX-License-Identifier: GPL-3.0-or-later                              |
+# |                                                                        |
+# |  BRIEF: Clean, formatted ntfy notification on push to a default branch. |
+# |         Issues use an org-level webhook; releases use notify.yml.       |
+# +========================================================================+
+name: "Universal: Push Notifications"
+
+on:
+  push:
+    branches: [main, master]
+
+permissions:
+  contents: read
+
+env:
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOKEN: ${{ secrets.NTFY_TOKEN }}
+
+jobs:
+  push-notify:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Notify push
+        # Untrusted values (commit message, actor) passed via env — never
+        # interpolated directly into the shell — to avoid command injection.
+        env:
+          REPO: ${{ github.repository }}
+          BRANCH: ${{ github.ref_name }}
+          ACTOR: ${{ github.actor }}
+          MSG: ${{ github.event.head_commit.message }}
+          CLICK: ${{ github.server_url }}/${{ github.repository }}/commit/${{ github.sha }}
+        run: |
+          SUMMARY=$(printf '%s\n' "$MSG" | head -n1)
+          curl -sS --retry 3 --retry-connrefused --retry-delay 2 --max-time 20 \
+            -H "Title: ${REPO}: push to ${BRANCH}" \
+            -H "Tags: package" \
+            -H "Priority: default" \
+            -H "Click: ${CLICK}" \
+            -H "Authorization: Bearer ${NTFY_TOKEN}" \
+            -d "${ACTOR}: ${SUMMARY}" \
+            "${NTFY_URL}/mokogit-push" || echo "::warning::ntfy notification could not be delivered (non-fatal)"

package/.mokogit/workflows/rc-revert.yml

@@ -0,0 +1,72 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGIT.Workflow
+# INGROUP: MokoCLI.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogit/workflows/rc-revert.yml
+# VERSION: 09.23.00
+# BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge
+
+name: "RC Revert"
+
+on:
+  pull_request:
+    types: [closed]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  revert:
+    name: Rename rc/ back to dev/
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.pull_request.merged == false &&
+      startsWith(github.event.pull_request.head.ref, 'rc/') &&
+      !startsWith(github.event.repository.name, 'Template-')
+
+    steps:
+      - name: Rename branch
+        env:
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+          REPO: ${{ github.repository }}
+          GIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
+          TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+        run: |
+          set -euo pipefail
+          # BRANCH is attacker-controlled (PR head ref). Strict allowlist before ANY use.
+          if ! printf '%s' "$BRANCH" | grep -Eq '^rc/[A-Za-z0-9._/-]+$'; then
+            echo "::error::Refusing unsafe branch name: $BRANCH"; exit 1
+          fi
+          SUFFIX="${BRANCH#rc/}"
+          DEV_BRANCH="dev/${SUFFIX}"
+          API="${GIT_URL}/api/v1/repos/${REPO}/branches"
+
+          # Create dev/ branch from rc/ branch
+          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X POST \
+            -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            -d "{\"new_branch_name\": \"${DEV_BRANCH}\", \"old_branch_name\": \"${BRANCH}\"}" \
+            "${API}" 2>/dev/null || true)
+          if [ "$STATUS" = "201" ]; then
+            echo "Created branch: ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "::error::Failed to create ${DEV_BRANCH} from ${BRANCH} (HTTP ${STATUS})"; exit 1
+          fi
+
+          # Read BRANCH from the environment inside PHP (getenv, no string interpolation -> no PHP injection)
+          ENCODED=$(php -r 'echo rawurlencode(getenv("BRANCH"));')
+          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
+            -H "Authorization: token ${TOKEN}" \
+            "${API}/${ENCODED}" 2>/dev/null || true)
+          if [ "$STATUS" = "204" ]; then
+            echo "Deleted branch: ${BRANCH}" >> "$GITHUB_STEP_SUMMARY"
+          else
+            echo "::warning::Failed to delete ${BRANCH} (HTTP ${STATUS})"
+          fi
+
+          echo "### RC Reverted" >> "$GITHUB_STEP_SUMMARY"
+          echo "${BRANCH} → ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"