@mokoconsulting/mcp-mokosuite 1.1.0-dev.372 → 1.1.0

package/.mokogit/workflows/auto-release.yml

@@ -7,8 +7,8 @@
 # INGROUP: MokoCLI.Release
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogit/workflows/auto-release.yml
-# VERSION: 06.02.00
-# BRIEF: Universal build & release � detects platform from metadata API
+# VERSION: 06.07.00
+# BRIEF: Universal build & release � detects platform from metadata API. BUMP-ON-DEV: base version + CHANGELOG promoted on dev pre-promotion (promote-rc), main publishes --bump none --no-commit so it never diverges from dev.
 #
 # +=======================================================================+
 # |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
@@ -152,6 +152,18 @@ jobs:
           fetch-depth: 1
           submodules: recursive
 
+      - name: "Require Makefile (auto-release gate)"
+        # RC promotion is part of auto-release; it must also refuse to run without
+        # a Makefile (see the release job for rationale). Post-checkout step because
+        # a job-level if: cannot inspect the workspace.
+        run: |
+          if [ ! -f Makefile ] && [ ! -f makefile ] && [ ! -f GNUmakefile ]; then
+            echo "::error::auto-release (RC promote) requires a Makefile at the repository root — none found. Aborting."
+            echo "## RC promote blocked: no Makefile at repo root" >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi
+          echo "Makefile present — RC promote may proceed."
+
       - name: Setup MokoCLI tools
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
@@ -195,6 +207,38 @@ jobs:
             echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
           fi
 
+      - name: "Bump base version + promote changelog on dev (pre-promotion)"
+        env:
+          # Contents-API writes to protected dev need the admin-bypass token
+          # (github.token cannot bypass branch protection). Same token/primitive
+          # as the changelog persist below (#510).
+          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
+        run: |
+          # "Bump on dev" (release-engineering inversion): move the base-version
+          # bump AND the CHANGELOG [Unreleased] promotion to dev BEFORE the
+          # promotion, so the rc cut (force-pushed from dev below) and the eventual
+          # main INHERIT the final version + promoted changelog. Nothing new is
+          # minted on main, so dev stays a clean superset and dev->main stops
+          # conflicting on Makefile/manifest/package.json/CHANGELOG.
+          #
+          # Only dev-headed promotions bump minor. fix/patch/hotfix/bugfix already
+          # carried their patch bump from auto-bump.yml on the branch — do NOT
+          # double-bump them (mirrors the release job's bump-level gate). Only runs
+          # for a real dev promotion (PR head == dev), never for a workflow_dispatch
+          # promote-rc (no PR head) — which is a manual re-cut of the current dev.
+          HEAD_REF="${{ github.event.pull_request.head.ref }}"
+          if [ "$HEAD_REF" != "dev" ]; then
+            echo "PR head '${HEAD_REF:-<none>}' is not dev — skipping dev pre-bump (fix/hotfix or manual re-cut)."
+            exit 0
+          fi
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          # release_bump_dev.php: minor-bump the base on dev + promote CHANGELOG on
+          # dev, both via the Contents API. Idempotent + monotonic (never moves dev
+          # down), so a PR re-synchronize that re-runs this step is a safe no-op.
+          php ${MOKO_CLI}/release_bump_dev.php \
+            --path . --branch dev --bump minor \
+            --token "${MOKOGIT_TOKEN}" --api-base "${API_BASE}"
+
       - name: Rename branch to rc
         env:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
@@ -261,8 +305,14 @@ jobs:
       - name: Publish RC release
         continue-on-error: true
         run: |
+          # --bump none (bump-on-dev): the base was already minor-bumped on dev by
+          # the pre-promotion step above, and rc was force-pushed FROM that dev, so
+          # rc already carries the final base. Bumping again here would double-bump
+          # (dev=+1, rc=+2). --no-commit: don't commit a version change back to rc
+          # (the rc tip must stay identical to the promoted dev). The RC release
+          # still stamps the -rc suffix on the inherited base in-tree.
           php ${MOKO_CLI}/release_publish.php \
-            --path . --stability rc --bump minor --branch rc \
+            --path . --stability rc --bump none --no-commit --branch rc \
             --token "${{ github.token }}"
 
       - name: Update RC release notes from CHANGELOG.md
@@ -307,7 +357,7 @@ jobs:
         if: always()
         run: |
           echo "## Promoted to Release Candidate" >> $GITHUB_STEP_SUMMARY
-          echo "Branch renamed to rc, minor bump, RC release built" >> $GITHUB_STEP_SUMMARY
+          echo "Base bumped + changelog promoted on dev (pre-promotion); rc cut from dev; RC release built" >> $GITHUB_STEP_SUMMARY
 
   # ── Merged PR → Build & Release (or promote RC to stable) ─────────────────────────
   release:
@@ -350,6 +400,20 @@ jobs:
           fetch-depth: 0
           submodules: recursive
 
+      - name: "Require Makefile (auto-release gate)"
+        # auto-release must not run without a Makefile: the pipeline drives its
+        # build/package targets through make, and a release-bearing repo is
+        # expected to ship one. Absence is a misconfiguration — fail loudly with
+        # a clear message rather than half-releasing. Must be a post-checkout step
+        # (a job-level if: cannot inspect the workspace).
+        run: |
+          if [ ! -f Makefile ] && [ ! -f makefile ] && [ ! -f GNUmakefile ]; then
+            echo "::error::auto-release requires a Makefile at the repository root — none found. A release-bearing repo must ship a Makefile (build/package targets). Aborting."
+            echo "## Release blocked: no Makefile at repo root" >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi
+          echo "Makefile present — auto-release may proceed."
+
       - name: Configure git for bot pushes
         env:
           MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
@@ -422,24 +486,27 @@ jobs:
       - name: "Determine version bump level"
         id: bump
         run: |
-          # Fix/patch branches: version was already bumped by pre-release, just strip suffix
-          # Feature/dev branches: bump minor for the new stable release
+          # Bump-on-dev: the base version is now bumped on DEV pre-promotion (the
+          # promote-rc job's release_bump_dev.php step), so main ALWAYS publishes
+          # the inherited version with NO bump. Historically a dev-headed promotion
+          # bumped minor here (on main) — that on-main bump is exactly the divergence
+          # this change removes. fix/patch/hotfix/bugfix were already 'none' (their
+          # patch came from auto-bump.yml on the branch). So every path is 'none' now.
           HEAD_REF="${{ github.event.pull_request.head.ref || 'dev' }}"
-          case "$HEAD_REF" in
-            fix/*|patch/*|hotfix/*|bugfix/*) BUMP="none" ;;
-            *)                               BUMP="minor" ;;
-          esac
+          BUMP="none"
           echo "level=${BUMP}" >> "$GITHUB_OUTPUT"
-          echo "Bump level: ${BUMP} (from branch: ${HEAD_REF})"
+          echo "Bump level: ${BUMP} (from branch: ${HEAD_REF}) — base bumped on dev pre-promotion"
 
       - name: "Publish stable release"
         run: |
-          BUMP_FLAG=""
-          if [ "${{ steps.bump.outputs.level }}" != "none" ]; then
-            BUMP_FLAG="--bump ${{ steps.bump.outputs.level }}"
-          fi
+          # Bump-on-dev: --bump none + --no-commit. The base was bumped on dev
+          # pre-promotion and inherited into main via the merge, so main neither
+          # bumps NOR commits a version change. release_publish still stamps the
+          # (unchanged) version in-tree so the built artifact is correct, but the
+          # commit/push back to main is suppressed -- this is what removes the
+          # main-only `chore(release): build` commit that diverged main from dev.
           php ${MOKO_CLI}/release_publish.php \
-            --path . --stability stable ${BUMP_FLAG} --branch main \
+            --path . --stability stable --bump none --no-commit --branch main \
             --token "${{ github.token }}"
 
       - name: "Read published version"
@@ -490,7 +557,7 @@ jobs:
 
           echo "semver_tag=${SEMVER_TAG}" >> "$GITHUB_OUTPUT"
 
-      - name: Update release notes and promote changelog
+      - name: Update release notes and reconcile changelog
         run: |
           API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
           TOKEN="${{ github.token }}"
@@ -536,16 +603,23 @@ jobs:
             echo "Release notes updated from CHANGELOG.md"
           fi
 
-          # Promote [Unreleased] → [version] in CHANGELOG.md via the shared mokocli command (#364).
-          # changelog_promote.php is idempotent (won't re-promote an existing version), merges
-          # duplicate headings, drops blank release sections, and collapses whitespace — verified
-          # byte-identical to the former inline promoter across 8 fixtures.
+          # Bump-on-dev: the CHANGELOG [Unreleased] -> [version] promotion now happens
+          # on DEV pre-promotion (promote-rc's release_bump_dev.php step), so main
+          # INHERITS the already-promoted changelog via the merge and this step
+          # normally has nothing to do. We keep an idempotent reconcile here as a
+          # safety-net for the fix/hotfix->main path (a fix/* PR merges straight to
+          # main WITHOUT going through dev/promote-rc, so its [Unreleased] section was
+          # never promoted). changelog_promote.php is idempotent (won't re-promote an
+          # existing version) and merges/normalizes, so on the dev path it is a no-op;
+          # on the fix path it promotes. The commit/push are already non-fatal
+          # (`|| true`): nothing to commit on the dev path, and the release itself is
+          # already published.
           if [ -n "$VERSION" ] && [ -f "CHANGELOG.md" ]; then
             php ${MOKO_CLI}/changelog_promote.php --path . --version "$VERSION"
             git add CHANGELOG.md
-            git commit -m "chore: promote changelog [Unreleased] → [${VERSION}] [skip ci]" || true
+            git commit -m "chore: reconcile changelog [Unreleased] → [${VERSION}] [skip ci]" || true
             git push origin main || true
-            echo "Changelog promoted: [Unreleased] → [${VERSION}]"
+            echo "Changelog reconciled on main for [${VERSION}] (idempotent; no-op on dev path)"
           fi
 
       - name: Dispatch npm publish (bump has persisted to main)
@@ -596,6 +670,50 @@ jobs:
 
 
 
+      # -- Post-release: prune superseded-major version branches ---------------
+      # Retention policy: keep every version/* branch of the CURRENT major and
+      # retire the branches of older majors. No-op until a major bump, so a
+      # normal release touches nothing. Same-repo deletes -> per-repo github.token.
+      - name: "Step 13: Prune superseded-major version branches (keep current major)"
+        if: steps.version.outputs.skip != 'true'
+        continue-on-error: true
+        run: |
+          API_BASE="${MOKOGIT_URL}/api/v1/repos/${GIT_ORG}/${GIT_REPO}"
+          TOKEN="${{ github.token }}"
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
+          CUR_MAJOR="$(printf '%s' "$VERSION" | cut -d. -f1)"
+          CUR_MAJOR="$((10#${CUR_MAJOR:-0}))"
+          echo "Retention: keep only current major ${CUR_MAJOR} (from ${VERSION})"
+
+          ALL=""; page=1
+          while [ "$page" -le 20 ]; do
+            RESP="$(curl -sf -H "Authorization: token ${TOKEN}" "${API_BASE}/branches?limit=50&page=${page}" 2>/dev/null || echo '[]')"
+            CHUNK="$(printf '%s' "$RESP" | python3 -c "import sys,json;[print(b['name']) for b in json.load(sys.stdin)]" 2>/dev/null || true)"
+            [ -z "$CHUNK" ] && break
+            ALL="$(printf '%s\n%s' "$ALL" "$CHUNK")"
+            page=$((page+1))
+          done
+
+          PRUNED=0; KEPT=0
+          while IFS= read -r br; do
+            [ -z "$br" ] && continue
+            case "$br" in version/*) ;; *) continue ;; esac
+            maj="$(printf '%s' "${br#version/}" | cut -d. -f1)"
+            case "$maj" in ''|*[!0-9]*) KEPT=$((KEPT+1)); continue ;; esac
+            if [ "$((10#$maj))" -lt "$CUR_MAJOR" ]; then
+              curl -sf -X DELETE -H "Authorization: token ${TOKEN}" "${API_BASE}/branches/${br}" 2>/dev/null \
+                && { echo "Pruned ${br}"; PRUNED=$((PRUNED+1)); } \
+                || echo "WARNING: could not prune ${br}"
+            else
+              KEPT=$((KEPT+1))
+            fi
+          done <<< "$ALL"
+
+          {
+            echo "### Version-branch retention"
+            echo "Current major \`${CUR_MAJOR}\` — kept ${KEPT}, pruned ${PRUNED} superseded-major branch(es)."
+          } >> "$GITHUB_STEP_SUMMARY"
+
       # -- Post-release: Reset dev version -----------------------------
       - name: "Post-release: Reset dev version"
         if: steps.version.outputs.skip != 'true'
@@ -645,7 +763,7 @@ jobs:
   scheduled-safety-net:
     name: Scheduled release safety-net
     runs-on: ubuntu-latest
-    if: github.event_name == 'schedule' && !startsWith(github.event.repository.name, 'Template-')
+    if: github.event_name == 'schedule' && !startsWith(github.event.repository.name, 'Template-') && (github.ref_name == 'main' || github.ref_name == 'stable')
     # Own-repo write: dispatch a release when main has unreleased changes.
     permissions:
       contents: read

package/.mokogit/workflows/cleanup.yml

@@ -19,6 +19,7 @@ on:
 
 permissions:
   contents: write
+  actions: write
 
 env:
   MOKOGIT_URL: ${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}
@@ -33,11 +34,11 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.MOKOGIT_TOKEN || github.token }}
+          token: ${{ github.token }}
 
       - name: Delete merged branches
         env:
-          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
+          MOKOGIT_TOKEN: ${{ github.token }}
         run: |
           echo "=== Merged Branch Cleanup ==="
           API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"
@@ -66,7 +67,7 @@ jobs:
 
       - name: Clean old workflow runs
         env:
-          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
+          MOKOGIT_TOKEN: ${{ github.token }}
         run: |
           echo "=== Workflow Run Cleanup ==="
           API="${MOKOGIT_URL}/api/v1/repos/${{ github.repository }}"

package/.mokogit/workflows/issue-branch.yml

@@ -32,7 +32,7 @@ jobs:
         # injection via a crafted issue title). Pass everything through env so
         # the values arrive as ordinary shell variables that are not re-parsed.
         env:
-          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN || github.token }}
+          MOKOGIT_TOKEN: ${{ github.token }}
           REPO: ${{ github.repository }}
           ISSUE_NUM: ${{ github.event.issue.number }}
           ISSUE_TITLE: ${{ github.event.issue.title }}