@mokoconsulting/mcp-mokosuite 1.1.0-dev.372 → 1.1.0

package/.mokogit/workflows/changelog-validation.yml

@@ -1,117 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# This file is part of a Moko Consulting project.
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: GitHub.Workflow.Template
-# INGROUP: MokoStandards.CI
-# REPO: https://github.com/mokoconsulting-tech/MokoStandards
-# PATH: /templates/workflows/shared/changelog-validation.yml.template
-# VERSION: 04.06.01
-# BRIEF: Validates CHANGELOG.md format and version consistency
-# NOTE: Deployed to .mokogit/workflows/changelog-validation.yml in governed repos.
-
-name: "Universal: Changelog Validation"
-
-on:
-  push:
-    branches:
-      - main
-  pull_request:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-concurrency:
-  # storm-reduction: collapse superseded validation runs on the same ref
-  group: ${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  validate-changelog:
-    name: Validate CHANGELOG.md
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-
-      - name: Check CHANGELOG.md exists
-        run: |
-          echo "### Changelog Validation" | tee -a $GITHUB_STEP_SUMMARY
-          if [ ! -f "CHANGELOG.md" ]; then
-            echo "CHANGELOG.md not found in repository root." | tee -a $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-          echo "CHANGELOG.md exists." | tee -a $GITHUB_STEP_SUMMARY
-
-      - name: Check VERSION header matches README.md (only if README declares one)
-        run: |
-          # A FILE INFORMATION VERSION block is optional in README.md — public-facing
-          # READMEs typically have none. Only enforce a CHANGELOG match when README
-          # actually declares a version; otherwise skip (not a failure).
-          # `|| true`: under the default `bash -e -o pipefail`, a grep with no match
-          # exits 1 and pipefail propagates it, which would abort the step BEFORE the
-          # `-z` skip below — the exact common case (README with no VERSION block). Keep
-          # the empty result non-fatal so the intended skip path stays reachable.
-          README_VERSION=$(grep -oP '^\s*VERSION:\s*\K[0-9]+\.[0-9]+\.[0-9]+' README.md 2>/dev/null | head -1 || true)
-          if [ -z "$README_VERSION" ]; then
-            echo "README.md has no FILE INFORMATION VERSION block — skipping version-match check." | tee -a $GITHUB_STEP_SUMMARY
-            exit 0
-          fi
-
-          CHANGELOG_VERSION=$(grep -oP '^\#\#\s*\[\K[0-9]+\.[0-9]+\.[0-9]+' CHANGELOG.md | head -1 || true)
-          if [ -z "$CHANGELOG_VERSION" ]; then
-            echo "README declares VERSION \`${README_VERSION}\` but CHANGELOG.md has no matching \`## [X.Y.Z]\` header." | tee -a $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-
-          if [ "$CHANGELOG_VERSION" != "$README_VERSION" ]; then
-            echo "CHANGELOG latest version \`${CHANGELOG_VERSION}\` does not match README VERSION \`${README_VERSION}\`." | tee -a $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-
-          echo "CHANGELOG version \`${CHANGELOG_VERSION}\` matches README VERSION." | tee -a $GITHUB_STEP_SUMMARY
-
-      - name: Validate conventional changelog format
-        run: |
-          ERRORS=0
-
-          # Validate the format of each version entry. `## [Unreleased]` is a valid
-          # Keep-a-Changelog section (not a dated version) and is skipped.
-          while IFS= read -r LINE; do
-            if echo "$LINE" | grep -qiE '^\#\#[[:space:]]*\[unreleased\]'; then
-              continue
-            fi
-            if ! echo "$LINE" | grep -qP '^\#\#\s*\[[0-9]+\.[0-9]+\.[0-9]+\]\s*[-–—]+\s*[0-9]{4}-[0-9]{2}-[0-9]{2}'; then
-              echo "Malformed version header: \`${LINE}\`" | tee -a $GITHUB_STEP_SUMMARY
-              echo "  Expected format: \`## [X.Y.Z] --- YYYY-MM-DD\` (any hyphen/dash separator)" | tee -a $GITHUB_STEP_SUMMARY
-              ERRORS=$((ERRORS + 1))
-            fi
-          done < <(grep -P '^\#\#\s*\[' CHANGELOG.md)
-
-          # Count real (dated) version entries, excluding the Unreleased section.
-          VERSION_COUNT=$(grep -P '^\#\#\s*\[' CHANGELOG.md | { grep -viE '\[unreleased\]' || true; } | wc -l | tr -d ' ')
-          HAS_UNRELEASED=$(grep -ciE '^\#\#[[:space:]]*\[unreleased\]' CHANGELOG.md | tr -d ' ')
-          if [ "$VERSION_COUNT" -eq 0 ] && [ "$HAS_UNRELEASED" -eq 0 ]; then
-            echo "No version entries or Unreleased section found in CHANGELOG.md." | tee -a $GITHUB_STEP_SUMMARY
-            ERRORS=$((ERRORS + 1))
-          else
-            echo "Found ${VERSION_COUNT} released version entr(ies)$([ "$HAS_UNRELEASED" -gt 0 ] && echo ' + an Unreleased section') in CHANGELOG.md." | tee -a $GITHUB_STEP_SUMMARY
-          fi
-
-          echo "" | tee -a $GITHUB_STEP_SUMMARY
-          if [ "${ERRORS}" -gt 0 ]; then
-            echo "**${ERRORS} format issue(s) found.**" | tee -a $GITHUB_STEP_SUMMARY
-            exit 1
-          else
-            echo "**Changelog format validation passed.**" | tee -a $GITHUB_STEP_SUMMARY
-          fi

package/.mokogit/workflows/custom-workflow-sync-trigger.yml

@@ -1,83 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGIT.Workflow
-# INGROUP: MokoCLI.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
-# PATH: /.mokogit/workflows/workflow-sync-trigger.yml
-# VERSION: 01.01.01
-# BRIEF: Trigger workflow sync to live repos when a PR is merged to main
-
-name: "Universal: Workflow Sync Trigger"
-
-on:
-  workflow_dispatch:
-  pull_request:
-    types: [closed]
-    branches:
-      - main
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  sync:
-    name: Sync workflows to live repos
-    runs-on: release
-    if: >-
-      startsWith(github.event.repository.name, 'Template-') &&
-      (github.event_name == 'workflow_dispatch' ||
-      (github.event.pull_request.merged == true &&
-      !contains(github.event.pull_request.title, '[skip sync]')))
-
-    steps:
-      - name: Determine platform from repo name
-        id: platform
-        run: |
-          REPO="${{ github.event.repository.name }}"
-          case "$REPO" in
-            Template-Joomla)   PLATFORM="joomla" ;;
-            Template-Dolibarr) PLATFORM="dolibarr" ;;
-            Template-Go)       PLATFORM="go" ;;
-            Template-NPM)      PLATFORM="npm" ;;
-            Template-Generic)  PLATFORM="" ;;
-            *)                 PLATFORM="" ;;
-          esac
-          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
-          echo "Platform: ${PLATFORM:-all}"
-
-      - name: Clone MokoCLI
-        env:
-          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
-        run: |
-          MOKOGIT_URL="${{ vars.MOKOGIT_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 "${MOKOGIT_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
-
-      - name: Install PHP
-        run: |
-          if ! command -v php &> /dev/null; then
-            apt-get update -qq && apt-get install -y -qq php-cli php-json php-curl > /dev/null 2>&1
-          fi
-
-      - name: Install dependencies
-        run: |
-          cd /tmp/mokocli
-          composer install --no-dev --no-interaction --quiet 2>/dev/null || true
-
-      - name: Run workflow sync
-        env:
-          MOKOGIT_TOKEN: ${{ secrets.MOKOGIT_TOKEN }}
-        run: |
-          ARGS="--token ${MOKOGIT_TOKEN}"
-          ARGS="${ARGS} --org ${{ vars.MOKOGIT_ORG || github.repository_owner }}"
-          ARGS="${ARGS} --phase repos"
-          ARGS="${ARGS} --delete-orphans"
-
-          PLATFORM="${{ steps.platform.outputs.platform }}"
-          if [ -n "$PLATFORM" ]; then
-            ARGS="${ARGS} --platform-filter ${PLATFORM}"
-          fi
-
-          php /tmp/mokocli/cli/workflow_sync.php ${ARGS}

package/.mokogit/workflows/gitleaks.yml

@@ -1,94 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGIT.Workflow
-# INGROUP: MokoCLI.Security
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
-# PATH: /.mokogit/workflows/gitleaks.yml
-# VERSION: 01.00.00
-# BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
-#
-# +========================================================================+
-# |                        SECRET SCANNING                                 |
-# +========================================================================+
-# |                                                                        |
-# |  Scans commits for leaked secrets using Gitleaks.                      |
-# |                                                                        |
-# |  - PR scan: only new commits in the PR                                 |
-# |  - Scheduled: full repo scan weekly                                    |
-# |  - Alerts via ntfy on findings                                         |
-# |                                                                        |
-# +========================================================================+
-
-name: "Universal: Secret Scanning"
-
-on:
-  schedule:
-    - cron: '0 5 * * 1'  # Weekly Monday 05:00 UTC
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
-  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'mokogit-security' }}
-  NTFY_TOKEN: ${{ secrets.NTFY_TOKEN }}
-
-jobs:
-  gitleaks:
-    name: Gitleaks Secret Scan
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Install Gitleaks
-        run: |
-          GITLEAKS_VERSION="8.21.2"
-          curl -sSL "https://github.com/gitleaks/gitleaks/releases/download/v${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION}_linux_x64.tar.gz" \
-            | tar -xz -C /usr/local/bin gitleaks
-          gitleaks version
-
-      - name: Scan for secrets
-        id: scan
-        run: |
-          echo "### Secret Scanning" >> $GITHUB_STEP_SUMMARY
-          ARGS="--source . --verbose --report-format json --report-path /tmp/gitleaks-report.json"
-
-          if [ "${{ github.event_name }}" = "pull_request" ]; then
-            # Scan only PR commits
-            ARGS="$ARGS --log-opts=${{ github.event.pull_request.base.sha }}..${{ github.event.pull_request.head.sha }}"
-            echo "Scanning PR commits only" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "Full repository scan" >> $GITHUB_STEP_SUMMARY
-          fi
-
-          if gitleaks detect $ARGS 2>&1; then
-            echo "result=clean" >> "$GITHUB_OUTPUT"
-            echo "**No secrets detected.**" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "result=found" >> "$GITHUB_OUTPUT"
-            FINDINGS=$(jq length /tmp/gitleaks-report.json 2>/dev/null || echo "unknown")
-            echo "**${FINDINGS} potential secret(s) detected.**" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "Review the findings and rotate any exposed credentials immediately." >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-
-      - name: Notify on findings
-        if: failure() && steps.scan.outputs.result == 'found'
-        run: |
-          REPO="${{ github.event.repository.name }}"
-          curl -sS \
-            -H "Title: ${REPO} — secrets detected in code" \
-            -H "Tags: rotating_light,key" \
-            -H "Priority: urgent" \
-            -d "Gitleaks found potential secrets. Review and rotate credentials immediately." \
-            -H "Authorization: Bearer ${NTFY_TOKEN}" \
-            "${NTFY_URL}/${NTFY_TOPIC}" || true

package/.mokogit/workflows/notify.yml

@@ -1,73 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGIT.Workflow
-# INGROUP: MokoCLI.Notifications
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
-# PATH: /.mokogit/workflows/notify.yml
-# VERSION: 01.00.00
-# BRIEF: Push notifications via ntfy on release success or workflow failure
-
-name: "Universal: Notifications"
-
-on:
-  workflow_run:
-    workflows:
-      - "Universal: Build & Release"
-      - "Joomla: Extension CI"
-      - "Generic: Project CI"
-    types:
-      - completed
-
-permissions:
-  contents: read
-
-env:
-  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
-  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'mokogit-releases' }}
-  NTFY_TOKEN: ${{ secrets.NTFY_TOKEN }}
-
-jobs:
-  notify:
-    name: Send Notification
-    runs-on: ubuntu-latest
-    if: >-
-      github.event.workflow_run.conclusion == 'success' ||
-      github.event.workflow_run.conclusion == 'failure'
-
-    steps:
-      - name: Notify on success (releases only)
-        if: >-
-          github.event.workflow_run.conclusion == 'success' &&
-          contains(github.event.workflow_run.name, 'Release')
-        run: |
-          REPO="${{ github.event.repository.name }}"
-          WORKFLOW="${{ github.event.workflow_run.name }}"
-          URL="${{ github.event.workflow_run.html_url }}"
-
-          curl -sS --retry 3 --retry-connrefused --retry-delay 2 --max-time 20 \
-            -H "Title: ${REPO} released" \
-            -H "Tags: white_check_mark,package" \
-            -H "Priority: default" \
-            -H "Click: ${URL}" \
-            -d "${WORKFLOW} completed successfully." \
-            -H "Authorization: Bearer ${NTFY_TOKEN}" \
-            "${NTFY_URL}/${NTFY_TOPIC}" || echo "::warning::ntfy notification could not be delivered (non-fatal)"
-
-      - name: Notify on failure
-        if: github.event.workflow_run.conclusion == 'failure'
-        run: |
-          REPO="${{ github.event.repository.name }}"
-          WORKFLOW="${{ github.event.workflow_run.name }}"
-          URL="${{ github.event.workflow_run.html_url }}"
-
-          curl -sS --retry 3 --retry-connrefused --retry-delay 2 --max-time 20 \
-            -H "Title: ${REPO} workflow failed" \
-            -H "Tags: x,warning" \
-            -H "Priority: high" \
-            -H "Click: ${URL}" \
-            -d "${WORKFLOW} failed. Check the run for details." \
-            -H "Authorization: Bearer ${NTFY_TOKEN}" \
-            "${NTFY_URL}/${NTFY_TOPIC}" || echo "::warning::ntfy notification could not be delivered (non-fatal)"