@vypdev/copilot 3.3.0 → 3.5.0

package/setup/workflows/copilot_pull_request_comment.yml

@@ -11,6 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 120
     permissions:
+      checks: write
       contents: read
     steps:
       - name: Checkout Repository
@@ -21,6 +22,10 @@ jobs:
 
       - uses: vypdev/copilot@v3
         with:
+          repository-locale: ${{ vars.REPOSITORY_LOCALE || 'en-US' }}
+          issues-locale: ${{ vars.ISSUES_LOCALE || '' }}
+          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || '' }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
           ai-ignore-files: ${{ vars.AI_IGNORE_FILES || 'build/*' }}
           debug: ${{ vars.DEBUG }}
           main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
@@ -31,15 +36,12 @@ jobs:
           release-tree: ${{ vars.RELEASE_TREE || 'release' }}
           docs-tree: ${{ vars.DOCS_TREE || 'docs' }}
           chore-tree: ${{ vars.CHORE_TREE || 'chore' }}
-          branch-management-always: ${{ vars.BRANCH_MANAGEMENT_ALWAYS || 'false' }}
+          issue-managed-branches: ${{ vars.ISSUE_MANAGED_BRANCHES || 'true' }}
+          pre-branch-sdd: ${{ vars.PRE_BRANCH_SDD || 'false' }}
           reopen-issue-on-push: ${{ vars.REOPEN_ISSUE_ON_PUSH || 'true' }}
           desired-assignees-count: ${{ vars.DESIRED_ASSIGNEES_COUNT || '1' }}
           desired-reviewers-count: ${{ vars.DESIRED_REVIEWERS_COUNT || '1' }}
-          merge-timeout: ${{ vars.MERGE_TIMEOUT || '600' }}
-          issues-locale: ${{ vars.ISSUES_LOCALE || 'en-US' }}
-          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || 'en-US' }}
           commit-prefix-transforms: ${{ vars.COMMIT_PREFIX_TRANSFORMS || 'replace-slash' }}
-          ai-pull-request-description: ${{ vars.AI_PULL_REQUEST_DESCRIPTION || 'true' }}
           ai-pull-request-description-mode: ${{ vars.AI_PULL_REQUEST_DESCRIPTION_MODE || 'replace' }}
           ai-members-only: ${{ vars.AI_MEMBERS_ONLY || 'false' }}
           ai-include-reasoning: ${{ vars.AI_INCLUDE_REASONING || 'false' }}
@@ -60,34 +62,34 @@ jobs:
           project-column-pull-request-in-progress: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_IN_PROGRESS || 'In Progress' }}
           agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
           agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
+          agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
           agent-effort: ${{ vars.AGENT_EFFORT }}
-          agent-command: ${{ vars.AGENT_COMMAND }}
+          agent-executable: ${{ vars.AGENT_EXECUTABLE }}
           findings-provider: ${{ vars.FINDINGS_PROVIDER }}
           findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
           findings-model: ${{ vars.FINDINGS_MODEL }}
           findings-effort: ${{ vars.FINDINGS_EFFORT }}
-          findings-command: ${{ vars.FINDINGS_COMMAND }}
+          findings-executable: ${{ vars.FINDINGS_EXECUTABLE }}
           fixer-provider: ${{ vars.FIXER_PROVIDER }}
           fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
           fixer-model: ${{ vars.FIXER_MODEL }}
           fixer-effort: ${{ vars.FIXER_EFFORT }}
-          fixer-command: ${{ vars.FIXER_COMMAND }}
+          fixer-executable: ${{ vars.FIXER_EXECUTABLE }}
           reviewer-provider: ${{ vars.REVIEWER_PROVIDER }}
           reviewer-model-provider: ${{ vars.REVIEWER_MODEL_PROVIDER }}
           reviewer-model: ${{ vars.REVIEWER_MODEL }}
           reviewer-effort: ${{ vars.REVIEWER_EFFORT }}
-          reviewer-command: ${{ vars.REVIEWER_COMMAND }}
+          reviewer-executable: ${{ vars.REVIEWER_EXECUTABLE }}
           planner-provider: ${{ vars.PLANNER_PROVIDER }}
           planner-model-provider: ${{ vars.PLANNER_MODEL_PROVIDER }}
           planner-model: ${{ vars.PLANNER_MODEL }}
           planner-effort: ${{ vars.PLANNER_EFFORT }}
-          planner-command: ${{ vars.PLANNER_COMMAND }}
+          planner-executable: ${{ vars.PLANNER_EXECUTABLE }}
           tester-provider: ${{ vars.TESTER_PROVIDER }}
           tester-model-provider: ${{ vars.TESTER_MODEL_PROVIDER }}
           tester-model: ${{ vars.TESTER_MODEL }}
           tester-effort: ${{ vars.TESTER_EFFORT }}
-          tester-command: ${{ vars.TESTER_COMMAND }}
+          tester-executable: ${{ vars.TESTER_EXECUTABLE }}
           project-ids: ${{ vars.PROJECT_IDS }}
           token: ${{ secrets.PAT }}
         env:
@@ -95,13 +97,9 @@ jobs:
           AGENT_MODEL_PROVIDER: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
           AGENT_MODEL: ${{ vars.AGENT_MODEL }}
           AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
-          AGENT_PROVISIONING: ${{ vars.AGENT_PROVISIONING || 'auto' }}
           AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
-          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-5.6-luna' }}
-          AGENT_COMMAND: ${{ vars.AGENT_COMMAND }}
-          CODEX_VERSION: ${{ vars.CODEX_VERSION }}
-          OPENCODE_VERSION: ${{ vars.OPENCODE_VERSION }}
-          CURSOR_INSTALLER_SHA256: ${{ vars.CURSOR_INSTALLER_SHA256 }}
+          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
+          AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
           OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
           OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
           ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
@@ -109,4 +107,4 @@ jobs:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
           CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
-          CODEX_ACCESS_TOKEN: ${{ secrets.CODEX_ACCESS_TOKEN }}
+          COPILOT_EVIDENCE_TOKEN: ${{ github.token }}

package/setup/workflows/copilot_pull_request_merge_queue.yml

@@ -0,0 +1,20 @@
+name: Copilot - Pull Request Merge Queue
+run-name: Copilot PR · ${{ github.event_name }}:${{ github.event.action }}
+
+on:
+  merge_group:
+    types: [checks_requested]
+
+jobs:
+  copilot-pull-request-required-check:
+    # GitHub required checks match the job name. Keep this identical to normal
+    # PR analysis while isolating merge-group runs in their own workflow.
+    name: Copilot - Pull Request
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    permissions:
+      checks: write
+      contents: read
+    steps:
+      - name: Confirm merge-group compatibility
+        run: echo "Copilot PR analysis already ran on each constituent pull request."

package/setup/workflows/copilot_pull_request_review_state.yml

@@ -0,0 +1,109 @@
+name: Copilot - Pull Request Review State
+run-name: Copilot PR review · ${{ github.event_name }}:${{ github.event.action }}
+
+on:
+  pull_request_review:
+    types: [submitted, edited, dismissed]
+
+jobs:
+  copilot-pull-request-review-state:
+    if: ${{ (vars.COPILOT_BOT_LOGIN == '' || github.actor != vars.COPILOT_BOT_LOGIN) && github.event.pull_request.head.repo.full_name == github.repository }}
+    name: Copilot - Pull Request Review State
+    runs-on: ubuntu-latest
+    timeout-minutes: 120
+    concurrency:
+      group: copilot-pr-${{ github.repository }}-${{ github.event.pull_request.head.ref || github.ref_name }}-review-state
+      cancel-in-progress: true
+    permissions:
+      checks: write
+      contents: read
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          fetch-depth: 0
+
+      - uses: vypdev/copilot@v3
+        with:
+          repository-locale: ${{ vars.REPOSITORY_LOCALE || 'en-US' }}
+          issues-locale: ${{ vars.ISSUES_LOCALE || '' }}
+          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || '' }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          ai-ignore-files: ${{ vars.AI_IGNORE_FILES || 'build/*' }}
+          debug: ${{ vars.DEBUG }}
+          main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
+          development-branch: ${{ vars.DEVELOPMENT_BRANCH || 'develop' }}
+          feature-tree: ${{ vars.FEATURE_TREE || 'feature' }}
+          bugfix-tree: ${{ vars.BUGFIX_TREE || 'bugfix' }}
+          hotfix-tree: ${{ vars.HOTFIX_TREE || 'hotfix' }}
+          release-tree: ${{ vars.RELEASE_TREE || 'release' }}
+          docs-tree: ${{ vars.DOCS_TREE || 'docs' }}
+          chore-tree: ${{ vars.CHORE_TREE || 'chore' }}
+          issue-managed-branches: ${{ vars.ISSUE_MANAGED_BRANCHES || 'true' }}
+          pre-branch-sdd: ${{ vars.PRE_BRANCH_SDD || 'false' }}
+          reopen-issue-on-push: ${{ vars.REOPEN_ISSUE_ON_PUSH || 'true' }}
+          desired-assignees-count: ${{ vars.DESIRED_ASSIGNEES_COUNT || '1' }}
+          desired-reviewers-count: ${{ vars.DESIRED_REVIEWERS_COUNT || '1' }}
+          commit-prefix-transforms: ${{ vars.COMMIT_PREFIX_TRANSFORMS || 'replace-slash' }}
+          ai-pull-request-description-mode: ${{ vars.AI_PULL_REQUEST_DESCRIPTION_MODE || 'replace' }}
+          ai-members-only: ${{ vars.AI_MEMBERS_ONLY || 'false' }}
+          ai-include-reasoning: ${{ vars.AI_INCLUDE_REASONING || 'false' }}
+          bugbot-severity: ${{ vars.BUGBOT_SEVERITY || 'low' }}
+          bugbot-comment-limit: ${{ vars.BUGBOT_COMMENT_LIMIT || '20' }}
+          bugbot-fix-verify-commands: ${{ vars.BUGBOT_AUTOFIX_VERIFY_COMMANDS }}
+          bugbot-dry-run: ${{ vars.BUGBOT_DRY_RUN || 'false' }}
+          bugbot-effort: ${{ vars.BUGBOT_EFFORT || 'smart' }}
+          bugbot-review-drafts: ${{ vars.BUGBOT_REVIEW_DRAFTS || 'false' }}
+          bugbot-trace-rules: ${{ vars.BUGBOT_TRACE_RULES || 'false' }}
+          bugbot-suggested-changes: ${{ vars.BUGBOT_SUGGESTED_CHANGES || 'true' }}
+          bugbot-telemetry: ${{ vars.BUGBOT_TELEMETRY || 'true' }}
+          bugbot-fail-on-unresolved: ${{ vars.BUGBOT_FAIL_ON_UNRESOLVED || 'false' }}
+          bugbot-organization-rules: ${{ vars.BUGBOT_ORGANIZATION_RULES }}
+          project-column-issue-created: ${{ vars.PROJECT_COLUMN_ISSUE_CREATED || 'Todo' }}
+          project-column-pull-request-created: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_CREATED || 'In Progress' }}
+          project-column-issue-in-progress: ${{ vars.PROJECT_COLUMN_ISSUE_IN_PROGRESS || 'In Progress' }}
+          project-column-pull-request-in-progress: ${{ vars.PROJECT_COLUMN_PULL_REQUEST_IN_PROGRESS || 'In Progress' }}
+          agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
+          agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
+          agent-model: ${{ vars.AGENT_MODEL || 'gpt-6-luna' }}
+          agent-effort: ${{ vars.AGENT_EFFORT }}
+          agent-executable: ${{ vars.AGENT_EXECUTABLE }}
+          findings-provider: ${{ vars.FINDINGS_PROVIDER }}
+          findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
+          findings-model: ${{ vars.FINDINGS_MODEL }}
+          findings-effort: ${{ vars.FINDINGS_EFFORT }}
+          findings-executable: ${{ vars.FINDINGS_EXECUTABLE }}
+          fixer-provider: ${{ vars.FIXER_PROVIDER }}
+          fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
+          fixer-model: ${{ vars.FIXER_MODEL }}
+          fixer-effort: ${{ vars.FIXER_EFFORT }}
+          fixer-executable: ${{ vars.FIXER_EXECUTABLE }}
+          planner-provider: ${{ vars.PLANNER_PROVIDER }}
+          planner-model-provider: ${{ vars.PLANNER_MODEL_PROVIDER }}
+          planner-model: ${{ vars.PLANNER_MODEL }}
+          planner-effort: ${{ vars.PLANNER_EFFORT }}
+          planner-executable: ${{ vars.PLANNER_EXECUTABLE }}
+          reviewer-provider: ${{ vars.REVIEWER_PROVIDER }}
+          reviewer-model-provider: ${{ vars.REVIEWER_MODEL_PROVIDER }}
+          reviewer-model: ${{ vars.REVIEWER_MODEL }}
+          reviewer-effort: ${{ vars.REVIEWER_EFFORT }}
+          reviewer-executable: ${{ vars.REVIEWER_EXECUTABLE }}
+          project-ids: ${{ vars.PROJECT_IDS }}
+          token: ${{ secrets.PAT }}
+        env:
+          AGENT_PROVIDER: ${{ vars.AGENT_PROVIDER || 'codex' }}
+          AGENT_MODEL_PROVIDER: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
+          AGENT_MODEL: ${{ vars.AGENT_MODEL }}
+          AGENT_EFFORT: ${{ vars.AGENT_EFFORT }}
+          AGENT_ALLOWED_MODEL_PROVIDERS: ${{ vars.AGENT_ALLOWED_MODEL_PROVIDERS || 'openai' }}
+          AGENT_ALLOWED_MODELS: ${{ vars.AGENT_ALLOWED_MODELS || 'openai/gpt-6-luna' }}
+          AGENT_EXECUTABLE: ${{ vars.AGENT_EXECUTABLE }}
+          OPENCODE_API_KEY: ${{ secrets.OPENCODE_API_KEY }}
+          OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
+          ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+          GOOGLE_API_KEY: ${{ secrets.GOOGLE_API_KEY }}
+          OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
+          CURSOR_API_KEY: ${{ (vars.AGENT_PROVIDER == 'cursor' || vars.FINDINGS_PROVIDER == 'cursor' || vars.FIXER_PROVIDER == 'cursor' || vars.PLANNER_PROVIDER == 'cursor' || vars.REVIEWER_PROVIDER == 'cursor' || vars.TESTER_PROVIDER == 'cursor') && secrets.CURSOR_API_KEY || '' }}
+          CODEX_API_KEY: ${{ secrets.CODEX_API_KEY }}
+          COPILOT_EVIDENCE_TOKEN: ${{ github.token }}

package/setup/workflows/hotfix_workflow.yml

@@ -3,230 +3,219 @@ name: Task - Hotfix
 on:
   workflow_dispatch:
     inputs:
-      version:
-        description: 'Hotfix version'
+      mode:
+        description: 'Internal orchestration phase'
         required: true
-        default: '1.0.0'
+        default: prepare
+        type: choice
+        options: [prepare, publish]
+      operation-id:
+        description: 'Internal durable operation identifier'
+        required: false
+        default: ''
+      version:
+        description: 'Hotfix version (MAJOR.MINOR.PATCH)'
+        required: false
+        default: ''
       title:
-        description: 'Title'
-        required: true
-        default: 'New Version'
+        description: 'Hotfix title'
+        required: false
+        default: ''
       changelog:
-        description: 'Changelog'
-        required: true
-        default: '- Several improvements'
+        description: 'Hotfix changelog'
+        required: false
+        default: ''
       issue:
         description: 'Launcher issue'
         required: true
-        default: '-1'
+
+concurrency:
+  group: copilot-deployment-${{ github.repository_id }}-${{ inputs.issue }}
+  cancel-in-progress: false
+  queue: max
 
 jobs:
-  queue-gate:
-    name: Wait for previous mutation workflows
+  validate:
+    name: Validate deployment command
     runs-on: ubuntu-latest
-    timeout-minutes: 120
-    permissions:
-      actions: read
-      contents: read
+    timeout-minutes: 5
+    permissions: {}
     steps:
-      - uses: actions/checkout@v5
-        with:
-          persist-credentials: false
-      - name: Admit workflow to mutation queue
-        uses: vypdev/copilot@v3
+      - name: Validate bounded orchestration inputs
+        uses: actions/github-script@v9
+        env:
+          MODE: ${{ inputs.mode }}
+          OPERATION_ID: ${{ inputs.operation-id }}
+          VERSION: ${{ inputs.version }}
+          ISSUE: ${{ inputs.issue }}
+          TITLE: ${{ inputs.title }}
+          CHANGELOG: ${{ inputs.changelog }}
         with:
-          queue-gate-only: 'true'
-          token: ${{ github.token }}
+          script: |
+            const mode = process.env.MODE;
+            const operationId = process.env.OPERATION_ID || '';
+            const version = process.env.VERSION || '';
+            const issueText = process.env.ISSUE || '';
+            const issue = Number(issueText);
+            const title = process.env.TITLE || '';
+            const changelog = process.env.CHANGELOG || '';
+            const errors = [];
+            if (!/^[1-9][0-9]*$/.test(issueText) || !Number.isSafeInteger(issue) || issue < 1) errors.push('Issue must be a positive safe integer.');
+            if (!/^[0-9]+\.[0-9]+\.[0-9]+$/.test(version)) errors.push('Version must use MAJOR.MINOR.PATCH.');
+            if (mode === 'prepare') {
+              if (operationId) errors.push('Operation ID must be empty in prepare mode.');
+              if (!title || title.length > 1000) errors.push('Title must contain 1-1000 characters.');
+              if (!changelog || changelog.length > 50000) errors.push('Changelog must contain 1-50000 characters.');
+            } else if (mode === 'publish') {
+              if (!/^[A-Za-z0-9][A-Za-z0-9._-]{7,127}$/.test(operationId)) errors.push('Operation ID is invalid.');
+              if (title || changelog) errors.push('Title and changelog must be empty in publish mode.');
+            } else errors.push('Mode must be prepare or publish.');
+            if (errors.length) core.setFailed(errors.join(' '));
 
   prepare-version-files:
-    name: Prepare files for hotfix
+    name: Prepare and validate hotfix
+    if: ${{ inputs.mode == 'prepare' }}
     runs-on: ubuntu-latest
-    needs: queue-gate
-    timeout-minutes: 15
+    needs: validate
+    timeout-minutes: 30
     permissions:
       contents: write
     steps:
       - uses: actions/checkout@v5
         with:
           persist-credentials: true
-
-      - name: Set up Node.js 24
-        uses: actions/setup-node@v7
-        with:
-          node-version: '24.x'
-
-      - name: Set up pnpm
-        uses: pnpm/action-setup@v5
-        with:
-          version: 10.12.4
-          standalone: false
-
-      - name: Install dependencies
-        run: pnpm install --frozen-lockfile
-
-      - name: Validate inputs
-        env:
-          VERSION: ${{ github.event.inputs.version }}
-          ISSUE: ${{ github.event.inputs.issue }}
-          TITLE: ${{ github.event.inputs.title }}
-          CHANGELOG: ${{ github.event.inputs.changelog }}
-        run: |
-          err=0
-          if ! [[ "$VERSION" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
-            echo "::error::Version must be in semver format (e.g. 1.0.0)."
-            err=1
-          fi
-          if ! [[ "$ISSUE" =~ ^-?[0-9]+$ ]]; then
-            echo "::error::Issue must be a number (e.g. 123 or -1)."
-            err=1
-          fi
-          if [[ ${#TITLE} -gt 1000 ]]; then
-            echo "::error::Title must be at most 1000 characters."
-            err=1
-          fi
-          if [[ ${#CHANGELOG} -gt 50000 ]]; then
-            echo "::error::Changelog must be at most 50000 characters."
-            err=1
-          fi
-          [[ $err -eq 0 ]] || exit 1
-
-      # Example: generic step to perform the version update or compilation (uncomment and adjust as needed)
-      # - name: Generic step
-      #   uses: whatever/action@v2 
-
-      - name: Commit updated package.json and dist directory
+      # Add project-specific version, build, validation, smoke-test and generated-file steps here.
+      - name: Commit prepared hotfix files
         uses: EndBug/add-and-commit@v9
         with:
-          add: './build/ ./package.json'
+          add: './'
           committer_name: GitHub Actions
           committer_email: actions@github.com
           default_author: user_info
-          message: 'gh-action: updated compiled files and bumped version to ${{ github.event.inputs.version }} (hotfix)'
+          message: 'gh-action: prepare hotfix ${{ inputs.version }}'
 
-  tag:
-    name: Publish version
+  promote:
+    name: Open production promotion
+    if: ${{ inputs.mode == 'prepare' }}
     runs-on: ubuntu-latest
-    timeout-minutes: 120
-    needs: [ prepare-version-files ]
+    needs: prepare-version-files
+    timeout-minutes: 10
     permissions:
       contents: read
+      issues: write
+      pull-requests: write
+      actions: write
     steps:
-      - name: Checkout Repository
-        uses: actions/checkout@v5
+      - uses: actions/checkout@v5
         with:
           persist-credentials: false
-        
-      - name: Copilot - Create Tag
+      - name: Create or resume promotion PR
         uses: vypdev/copilot@v3
-        if: ${{ success() }}
         with:
-          debug: ${{ vars.DEBUG }}
+          single-action: prepare_deployment_action
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          single-action-version: ${{ inputs.version }}
+          single-action-title: ${{ inputs.title }}
+          single-action-changelog: ${{ inputs.changelog }}
           main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
           development-branch: ${{ vars.DEVELOPMENT_BRANCH || 'develop' }}
           release-tree: ${{ vars.RELEASE_TREE || 'release' }}
           hotfix-tree: ${{ vars.HOTFIX_TREE || 'hotfix' }}
-          single-action: 'create_tag'
-          single-action-issue: '${{ github.event.inputs.issue }}'
-          single-action-version: '${{ github.event.inputs.version }}'
-          agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
-          agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
-          agent-effort: ${{ vars.AGENT_EFFORT }}
-          agent-command: ${{ vars.AGENT_COMMAND }}
-          findings-provider: ${{ vars.FINDINGS_PROVIDER }}
-          findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
-          findings-model: ${{ vars.FINDINGS_MODEL }}
-          findings-effort: ${{ vars.FINDINGS_EFFORT }}
-          findings-command: ${{ vars.FINDINGS_COMMAND }}
-          fixer-provider: ${{ vars.FIXER_PROVIDER }}
-          fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
-          fixer-model: ${{ vars.FIXER_MODEL }}
-          fixer-effort: ${{ vars.FIXER_EFFORT }}
-          fixer-command: ${{ vars.FIXER_COMMAND }}
+          release-workflow: ${{ vars.RELEASE_WORKFLOW || 'release_workflow.yml' }}
+          hotfix-workflow: ${{ vars.HOTFIX_WORKFLOW || 'hotfix_workflow.yml' }}
+          release-reconciliation-strategy: ${{ vars.RELEASE_RECONCILIATION_STRATEGY || 'production-lineage' }}
+          hotfix-reconciliation-strategy: ${{ vars.HOTFIX_RECONCILIATION_STRATEGY || 'production-lineage' }}
+          reconciliation-pr-mode: ${{ vars.RECONCILIATION_PR_MODE || 'auto' }}
+          merge-queue-check-attestations: ${{ vars.MERGE_QUEUE_CHECK_ATTESTATIONS || '[]' }}
+          reconciliation-backmerge-mode: ${{ vars.RECONCILIATION_BACKMERGE_MODE || 'auto' }}
+          hotfix-active-release-policy: ${{ vars.HOTFIX_ACTIVE_RELEASE_POLICY || 'prefer-release' }}
+          reconciliation-tree: ${{ vars.RECONCILIATION_TREE || 'sync' }}
+          reconciliation-cleanup: ${{ vars.RECONCILIATION_CLEANUP || 'all' }}
+          reconciliation-issue-completion: ${{ vars.RECONCILIATION_ISSUE_COMPLETION || 'close' }}
+          orchestration-presentation-mode: ${{ vars.ORCHESTRATION_PRESENTATION_MODE || 'guided' }}
+          orchestration-diagrams: ${{ vars.ORCHESTRATION_DIAGRAMS || 'true' }}
+          orchestration-comment-mode: ${{ vars.ORCHESTRATION_COMMENT_MODE || 'update' }}
+          repository-locale: ${{ vars.REPOSITORY_LOCALE || 'en-US' }}
+          issues-locale: ${{ vars.ISSUES_LOCALE || '' }}
+          pull-requests-locale: ${{ vars.PULL_REQUESTS_LOCALE || '' }}
+          token: ${{ secrets.PAT }}
+
+  publish:
+    name: Publish accepted production commit
+    if: ${{ inputs.mode == 'publish' }}
+    runs-on: ubuntu-latest
+    needs: validate
+    timeout-minutes: 30
+    permissions:
+      contents: write
+      issues: write
+      pull-requests: write
+    steps:
+      - uses: actions/checkout@v5
+        with:
+          persist-credentials: false
+          ref: ${{ vars.MAIN_BRANCH || 'master' }}
+      - name: Create or verify production tag
+        uses: vypdev/copilot@v3
+        with:
+          single-action: create_tag
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          single-action-operation-id: ${{ inputs.operation-id }}
+          single-action-version: ${{ inputs.version }}
           token: ${{ secrets.PAT }}
-  
-      - name: Copilot - Create Release
+      # Add project-specific deployment here. It runs only after production promotion merged.
+      - name: Create or verify GitHub Release
         uses: vypdev/copilot@v3
-        if: ${{ success() }}
         with:
-          debug: ${{ vars.DEBUG }}
-          main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
-          development-branch: ${{ vars.DEVELOPMENT_BRANCH || 'develop' }}
-          release-tree: ${{ vars.RELEASE_TREE || 'release' }}
-          hotfix-tree: ${{ vars.HOTFIX_TREE || 'hotfix' }}
-          single-action: 'create_release'
-          single-action-issue: '${{ github.event.inputs.issue }}'
-          single-action-version: '${{ github.event.inputs.version }}'
-          single-action-title: '${{ github.event.inputs.title }}'
-          single-action-changelog: '${{ github.event.inputs.changelog }}'
-          agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
-          agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
-          agent-effort: ${{ vars.AGENT_EFFORT }}
-          agent-command: ${{ vars.AGENT_COMMAND }}
-          findings-provider: ${{ vars.FINDINGS_PROVIDER }}
-          findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
-          findings-model: ${{ vars.FINDINGS_MODEL }}
-          findings-effort: ${{ vars.FINDINGS_EFFORT }}
-          findings-command: ${{ vars.FINDINGS_COMMAND }}
-          fixer-provider: ${{ vars.FIXER_PROVIDER }}
-          fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
-          fixer-model: ${{ vars.FIXER_MODEL }}
-          fixer-effort: ${{ vars.FIXER_EFFORT }}
-          fixer-command: ${{ vars.FIXER_COMMAND }}
+          single-action: create_release
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          single-action-operation-id: ${{ inputs.operation-id }}
+          single-action-version: ${{ inputs.version }}
           token: ${{ secrets.PAT }}
-
-      # Example: generic step to perform the deployment (uncomment and adjust as needed)
-      # - name: Generic step
-      #   uses: whatever/action@v2 
-
-      - name: Copilot - Deploy success notification
+      - name: Start configured reconciliation
         uses: vypdev/copilot@v3
-        if: ${{ success() }}
         with:
-          debug: ${{ vars.DEBUG }}
-          main-branch: ${{ vars.MAIN_BRANCH || 'master' }}
-          development-branch: ${{ vars.DEVELOPMENT_BRANCH || 'develop' }}
-          release-tree: ${{ vars.RELEASE_TREE || 'release' }}
-          hotfix-tree: ${{ vars.HOTFIX_TREE || 'hotfix' }}
-          single-action: 'deployed_action'
-          single-action-issue: '${{ github.event.inputs.issue }}'
-          agent-provider: ${{ vars.AGENT_PROVIDER || 'codex' }}
-          agent-model-provider: ${{ vars.AGENT_MODEL_PROVIDER || 'openai' }}
-          agent-model: ${{ vars.AGENT_MODEL || 'gpt-5.6-luna' }}
-          agent-effort: ${{ vars.AGENT_EFFORT }}
-          agent-command: ${{ vars.AGENT_COMMAND }}
-          findings-provider: ${{ vars.FINDINGS_PROVIDER }}
-          findings-model-provider: ${{ vars.FINDINGS_MODEL_PROVIDER }}
-          findings-model: ${{ vars.FINDINGS_MODEL }}
-          findings-effort: ${{ vars.FINDINGS_EFFORT }}
-          findings-command: ${{ vars.FINDINGS_COMMAND }}
-          fixer-provider: ${{ vars.FIXER_PROVIDER }}
-          fixer-model-provider: ${{ vars.FIXER_MODEL_PROVIDER }}
-          fixer-model: ${{ vars.FIXER_MODEL }}
-          fixer-effort: ${{ vars.FIXER_EFFORT }}
-          fixer-command: ${{ vars.FIXER_COMMAND }}
+          single-action: published_deployment_action
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          single-action-operation-id: ${{ inputs.operation-id }}
+          single-action-version: ${{ inputs.version }}
           token: ${{ secrets.PAT }}
 
   report-failure:
-    name: Report deployment failure
+    name: Report orchestration failure
     runs-on: ubuntu-latest
     timeout-minutes: 5
-    needs: [ queue-gate, prepare-version-files, tag ]
-    if: ${{ failure() && github.event.inputs.issue != '-1' }}
+    needs: [validate, prepare-version-files, promote, publish]
+    if: ${{ failure() && needs.validate.result == 'success' }}
     permissions:
       issues: write
     steps:
-      - name: Report failure on launcher issue
-        # This tag is published after the release changes reach master.
+      - name: Persist publication failure
+        if: ${{ inputs.mode == 'publish' }}
+        uses: vypdev/copilot@v3
+        with:
+          single-action: failed_deployment_action
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
+          single-action-operation-id: ${{ inputs.operation-id }}
+          single-action-version: ${{ inputs.version }}
+          single-action-message: Publication failed. Review ${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }} before retrying.
+          token: ${{ secrets.PAT }}
+      - name: Report preparation failure
+        if: ${{ inputs.mode == 'prepare' }}
         uses: vypdev/copilot@v3
         with:
           single-action: publish_issue_comment
-          single-action-issue: '${{ github.event.inputs.issue }}'
+          single-action-issue: ${{ inputs.issue }}
+          issue-workflow-profile: ${{ vars.COPILOT_ISSUE_WORKFLOW_PROFILE || '' }}
           single-action-message: |
-            ## ❌ Hotfix deployment failed
+            ## ❌ Hotfix orchestration needs attention
 
-            The hotfix workflow did not complete successfully.
+            Phase `${{ inputs.mode }}` failed. Review the control center before retrying.
 
             [Review the workflow run](${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }})
-          token: ${{ github.token }}
+          token: ${{ secrets.PAT }}