repowarden 4.7.1 → 4.8.0-next.12

package/bin/npm-publication

@@ -24,11 +24,13 @@ source "$ROOT/hooks/lib/common.sh"
 REPO=""
 WORKFLOW="release.yml"
 ENVIRONMENT=""
+DRY_RUN=false
 while [ $# -gt 0 ]; do
     case "$1" in
         --repo) shift; REPO="${1:?--repo attend propriétaire/nom}" ;;
         --workflow) shift; WORKFLOW="${1:?--workflow attend un fichier}" ;;
         --environnement | --environment) shift; ENVIRONMENT="${1:?--environnement attend un nom}" ;;
+        --dry-run) DRY_RUN=true ;;
         -h | --help) sed -n '2,17p' "$0" | sed 's/^# \{0,1\}//'; exit 0 ;;
         *) err_t install.unknown_arg "$1"; exit 1 ;;
     esac
@@ -50,6 +52,67 @@ name="$(node -p 'require("./package.json").name')"
 # les doublons, y compris celui d'une tentative interrompue) ; tous révoqués à la fin
 TOKEN_PREFIX="repowarden-ci-${REPO##*/}"
 
+# Vérifie si une relation de confiance correspond aux paramètres attendus.
+# Affiche l'écart si --dry-run ou pour confirmation.
+# Retourne : 0 = match, 1 = pas de relation, 2 = relation différente
+verifier_trust() {
+    local json attendu_repo="$REPO" attendu_file="$WORKFLOW" attendu_env="$ENVIRONMENT"
+    json="$(npm trust list "$name" --json 2>/dev/null || echo '[]')"
+    if [ "$json" = "[]" ] || [ -z "$json" ]; then
+        return 1
+    fi
+    local match=0 id repo file env allow_publish
+    while IFS=$'\t' read -r id repo file env allow_publish; do
+        [ -n "$id" ] || continue
+        if [ "$repo" = "$attendu_repo" ] && [ "$file" = "$attendu_file" ] && [ "$env" = "$attendu_env" ] && [ "$allow_publish" = "true" ]; then
+            match=1
+            break
+        fi
+    done < <(node -e "
+        const data = $json;
+        for (const t of data) {
+            const id = t.id || t.key;
+            const repo = t.repository || t.repo || '';
+            const file = t.file || t.workflow || '';
+            const env = t.environment || t.env || '';
+            const allowPublish = t.allowPublish === true || t['allow-publish'] === true;
+            console.log(id + '\t' + repo + '\t' + file + '\t' + env + '\t' + allowPublish);
+        }
+    ")
+    if [ "$match" = 1 ]; then
+        return 0
+    fi
+    return 2
+}
+
+# Affiche les détails d'une relation de confiance pour diagnostic
+afficher_trust() {
+    local json
+    json="$(npm trust list "$name" --json 2>/dev/null || echo '[]')"
+    if [ "$json" = "[]" ] || [ -z "$json" ]; then
+        echo "  (aucune relation de confiance)"
+        return
+    fi
+    node -e "
+        const data = $json;
+        for (const t of data) {
+            const id = t.id || t.key;
+            const repo = t.repository || t.repo || '(inconnu)';
+            const file = t.file || t.workflow || '(inconnu)';
+            const env = t.environment || t.env || '(aucun)';
+            const allowPublish = t.allowPublish === true || t['allow-publish'] === true;
+            const allowStagePublish = t.allowStagePublish === true || t['allow-stage-publish'] === true;
+            console.log('  ID: ' + id);
+            console.log('  Dépôt: ' + repo);
+            console.log('  Workflow: ' + file);
+            console.log('  Environnement: ' + env);
+            console.log('  npm publish: ' + (allowPublish ? 'oui' : 'non'));
+            console.log('  npm stage publish: ' + (allowStagePublish ? 'oui' : 'non'));
+            console.log('');
+        }
+    "
+}
+
 brand "npm · $name · $REPO"
 
 # 1. Connexion npm : entre toi et npm (navigateur ou mot de passe)
@@ -127,16 +190,82 @@ fi
 
 # 3. Publication de confiance, puis plus aucun jeton
 step_t npm.step_trust
-if grep -q '"id"' <<<"$(npm trust list "$name" --json 2>/dev/null || true)"; then
+verifier_trust
+cas=$?
+if [ "$cas" = 0 ]; then
     ok_t npm.trust_exists
+elif [ "$cas" = 1 ]; then
+    # Aucune relation : créer
+    if [ "$DRY_RUN" = true ]; then
+        info_t npm.trust_would_create "$REPO" "$WORKFLOW" "${ENVIRONMENT:-(aucun)}"
+    else
+        npm trust github "$name" --file "$WORKFLOW" --repo "$REPO" ${ENVIRONMENT:+--env "$ENVIRONMENT"} --allow-publish --yes
+        ok_t npm.trust_set "$REPO" "$WORKFLOW"
+    fi
 else
-    npm trust github "$name" --file "$WORKFLOW" --repo "$REPO" ${ENVIRONMENT:+--env "$ENVIRONMENT"} --allow-publish --yes
-    ok_t npm.trust_set "$REPO" "$WORKFLOW"
+    # Relation différente : afficher l'écart, demander confirmation, corriger sans perte
+    attention_t npm.trust_mismatch
+    afficher_trust
+    echo "  Attendu :"
+    echo "  Dépôt: $REPO"
+    echo "  Workflow: $WORKFLOW"
+    echo "  Environnement: ${ENVIRONMENT:-(aucun)}"
+    echo "  npm publish: oui"
+    echo ""
+    if [ "$DRY_RUN" = true ]; then
+        info_t npm.trust_would_fix
+    else
+        # Confirmation avant changement
+        if [ -t 0 ]; then
+            t npm.trust_confirm
+            read -r -p "  $REPLY" rep
+            echo
+            [[ "$rep" =~ ^[OoYy]$ ]] || { err_t npm.trust_cancelled; exit 1; }
+        fi
+        # Créer la nouvelle relation AVANT de révoquer l'ancienne (pas de perte)
+        npm trust github "$name" --file "$WORKFLOW" --repo "$REPO" ${ENVIRONMENT:+--env "$ENVIRONMENT"} --allow-publish --yes
+        ok_t npm.trust_set "$REPO" "$WORKFLOW"
+        # Révoquer l'ancienne relation
+        json="$(npm trust list "$name" --json 2>/dev/null || echo '[]')"
+        old_id="$(node -e "
+            const data = $json;
+            for (const t of data) {
+                const id = t.id || t.key;
+                const repo = t.repository || t.repo || '';
+                const file = t.file || t.workflow || '';
+                const env = t.environment || t.env || '';
+                const allowPublish = t.allowPublish === true || t['allow-publish'] === true;
+                if (repo !== '$REPO' || file !== '$WORKFLOW' || env !== '$ENVIRONMENT' || allowPublish !== true) {
+                    console.log(id);
+                }
+            }
+        ")"
+        for id in $old_id; do
+            [ -n "$id" ] && npm trust revoke "$name" --id "$id" --yes && ok_t npm.trust_revoked "$id"
+        done
+    fi
 fi
 gh variable set REPOWARDEN_NPM --repo "$REPO" --body true
 if grep -q '^NPM_TOKEN' <<<"$(gh secret list --repo "$REPO")"; then
-    gh secret delete NPM_TOKEN --repo "$REPO"
-    ok_t npm.token_removed
+    if [ "$cas" = 0 ] || [ "$cas" = 2 ]; then
+        # Relation de confiance OK (ou corrigée) : signaler le token et proposer suppression
+        attention_t npm.token_present
+        if [ "$DRY_RUN" = true ]; then
+            info_t npm.token_would_remove
+        elif [ -t 0 ]; then
+            t npm.token_remove_confirm
+            read -r -p "  $REPLY" rep
+            echo
+            [[ "$rep" =~ ^[OoYy]$ ]] && gh secret delete NPM_TOKEN --repo "$REPO" && ok_t npm.token_removed
+        else
+            gh secret delete NPM_TOKEN --repo "$REPO"
+            ok_t npm.token_removed
+        fi
+    else
+        # Pas de relation de confiance : supprimer silencieusement (comportement existant)
+        gh secret delete NPM_TOKEN --repo "$REPO"
+        ok_t npm.token_removed
+    fi
 fi
 # Jetons temporaires révoqués sur npm (retrouvés par leur préfixe). npm peut
 # demander un code 2FA : la commande garde le terminal (questions visibles)

package/bin/proteger

@@ -193,7 +193,15 @@ if [ -n "$integration" ]; then
     # develop ne l'a pas reçu (retour main → develop vide après chaque
     # release). Une livraison n'apporte que develop, vérifiée par la CI ; le
     # retour reste fait quand main a un contenu propre (correctif direct).
+    # Garde-fou de livraison (statut posé par release-auto) : la livraison ne
+    # se merge que si elle peut aboutir (préversion publiée, protection en place)
+    contexts_branches="$contexts"
+    if grep -qs "release-auto.yml" "$GIT_TOPLEVEL"/.github/workflows/*.y*ml; then
+        contexts="${contexts:+$contexts,} {\"context\": \"livraison\", \"integration_id\": 15368}"
+        livraison_exigee=1
+    fi
     [ -z "$others" ] || rulesets+=("$(branch_ruleset repowarden "$others" '"merge"' false "$livraison" "$last_push" "$deploiement")")
+    contexts="$contexts_branches"
     # Branche d'intégration : squash seul (un commit par PR de travail, titre =
     # message : les commits intermédiaires n'entrent jamais) ; plus de retour
     # main → develop à merger, seuls develop et ses instantanés livraison/*
@@ -254,6 +262,7 @@ fi
 echo_t ci.proteger.1 "$REPO"
 echo_t ci.proteger.2 "$existing"
 echo_t ci.proteger.3 "$CHECKS"
+[ -z "${livraison_exigee:-}" ] || echo_t ci.proteger.livraison_check
 echo_t ci.proteger.4 "$methods" "$delete_on_merge"
 if [ -n "$integration" ] && [ "$DELIVERY" = deployment ]; then
     echo_t ci.proteger.delivery_deploy "$ENVIRONMENT" "$auto_merge"
@@ -308,10 +317,76 @@ sig_attendue() {
         "$(sed -n 's/.*"require_last_push_approval": \([a-z]*\).*/\1/p' <<<"$r")" \
         "$(sed -n 's/.*"require_code_owner_review": \([a-z]*\).*/\1/p' <<<"$r")" "$deps" "$checks"
 }
+# Anciens rulesets : rulesets de branche du dépôt, sous un autre nom que ceux
+# de repowarden, qui exigent encore la vérification « repogarde » (retirée en
+# v4) ; posés à la main ou par une ancienne version. Laissés à côté, ils
+# bloqueraient les branches pour toujours. Une ligne par ruleset dans ANCIENS :
+# id, nom, branches couvertes (~DEFAULT_BRANCH résolu : la branche par défaut
+# change ensuite dans le flux develop), séparés par des tabulations.
+# shellcheck disable=SC2016 # expressions jq (gh --jq), pas du shell
+anciens_rulesets() {
+    local ids id ligne defaut=""
+    ANCIENS=""
+    ids="$(gh api "repos/$REPO/rulesets" --jq '.[] | select(.target == "branch"
+        and (.source_type // "Repository") == "Repository"
+        and (.name | test("^(repowarden|repogarde)( \\(.*\\))?$") | not)) | .id')" || return 0
+    for id in $ids; do
+        ligne="$(gh api "repos/$REPO/rulesets/$id" --jq 'select([.rules[]? | select(.type == "required_status_checks")
+            | .parameters.required_status_checks[].context] | index("repogarde"))
+            | "\(.id)\t\(.name)\t\(.conditions.ref_name.include | join(" "))"')" || continue
+        [ -n "$ligne" ] || continue
+        if [[ "$ligne" == *"~DEFAULT_BRANCH"* ]]; then
+            [ -n "$defaut" ] || defaut="$(gh api "repos/$REPO" --jq .default_branch)"
+            ligne="${ligne//\~DEFAULT_BRANCH/refs/heads/$defaut}"
+        fi
+        ANCIENS="$ANCIENS$ligne"$'\n'
+    done
+}
+
+# Ancien ruleset (ligne de ANCIENS) couvrant une des branches du ruleset $2 (JSON)
+couvre() {
+    local motifs m b
+    read -ra motifs <<<"$(cut -f3 <<<"$1")"
+    for m in ${motifs[@]+"${motifs[@]}"}; do
+        [ "$m" != "~ALL" ] || return 0
+        for b in $(grep -o '"refs/heads/[^"]*"' <<<"$2" | tr -d '"'); do
+            # shellcheck disable=SC2053 # motif de GitHub (refs/heads/release/*)
+            [[ "$b" != $m ]] || return 0
+        done
+    done
+    return 1
+}
+
+# Réponse d'erreur de GitHub (JSON) → « message : erreurs », lisible
+erreur_github() {
+    local message="" erreurs="" re_message='"message": *"([^"]*)"' re_erreurs='"errors": *\[([^]]*)\]'
+    [[ ! "$1" =~ $re_message ]] || message="${BASH_REMATCH[1]}"
+    [[ ! "$1" =~ $re_erreurs ]] || erreurs="${BASH_REMATCH[1]//\"/}"
+    if [ -n "$message" ]; then
+        REPLY="$message${erreurs:+ : $erreurs}"
+    else
+        REPLY="$(tr '\n' ' ' <<<"$1")"
+    fi
+}
+
+# Rulesets indisponibles (dépôt privé d'un compte gratuit : GitHub les refuse
+# en 403) : les réglages du dépôt restent appliqués, les rulesets sautés avec
+# un message clair au lieu d'un arrêt sans explication
+RULESETS_OK=1
+if ! reponse="$(gh api "repos/$REPO/rulesets" 2>&1)" && [[ "$reponse" == *"403"* ]]; then
+    RULESETS_OK=""
+fi
+ANCIENS=""
+[ -z "$RULESETS_OK" ] || anciens_rulesets
+
 # shellcheck disable=SC2016 # expression jq (gh --jq), pas du shell
 SIG_EN_LIGNE='(.rules | map(select(.type == "pull_request"))[0].parameters) as $p
     | "approbations=\($p.required_approving_review_count) dernier_push=\($p.require_last_push_approval) codeowners=\($p.require_code_owner_review) deploiement=\([.rules[] | select(.type == "required_deployments") | .parameters.required_deployment_environments[]] | join(",")) verifications=\([.rules[] | select(.type == "required_status_checks") | .parameters.required_status_checks[].context] | sort | join(","))"'
 
+if [ -n "$VERIFY" ] && [ -z "$RULESETS_OK" ]; then
+    err_t ci.proteger.rulesets_unavailable "$REPO"
+    exit 1
+fi
 if [ -n "$VERIFY" ]; then
     ecarts=0
     for ruleset in "${rulesets[@]}"; do
@@ -335,6 +410,11 @@ if [ -n "$VERIFY" ]; then
             ecarts=$((ecarts + 1))
         fi
     done
+    while IFS=$'\t' read -r id name _; do
+        [ -n "$id" ] || continue
+        err_t ci.proteger.verify_legacy "$name" "$id"
+        ecarts=$((ecarts + 1))
+    done <<<"$ANCIENS"
     [ "$ecarts" = 0 ] || { err_t ci.proteger.verify_fix; exit 1; }
     ok_t ci.proteger.verify_ok
     exit 0
@@ -348,6 +428,7 @@ if [ -n "$integration" ] && ! gh api "repos/$REPO/labels/urgent" --silent 2>/dev
 fi
 
 if [ -n "$DRY_RUN" ]; then
+    [ -n "$RULESETS_OK" ] || attention_t ci.proteger.rulesets_unavailable "$REPO"
     printf '%s\n' "${rulesets[@]}"
     [ -z "$env_json" ] || printf '%s\n' "$env_json"
     exit 0
@@ -361,21 +442,60 @@ gh api -X PATCH "repos/$REPO" --silent "${settings[@]}"
 gh api -X PUT "repos/$REPO/actions/permissions/workflow" --silent \
     -f default_workflow_permissions=read -F can_approve_pull_request_reviews=true
 
-for ruleset in "${rulesets[@]}"; do
+echecs=0
+[ -n "$RULESETS_OK" ] || { attention_t ci.proteger.rulesets_unavailable "$REPO"; rulesets=(); }
+for ruleset in ${rulesets[@]+"${rulesets[@]}"}; do
     name="$(sed -n 's/^  "name": "\(.*\)",$/\1/p' <<<"$ruleset")"
     # Ruleset posé sous l'ancien nom (repogarde, v3) : repris et renommé, sinon
     # il resterait à côté et exigerait une vérification « repogarde » disparue
     old="${name/repowarden/repogarde}"
     id="$(gh api "repos/$REPO/rulesets" \
         --jq "([.[] | select(.name == \"$name\")] + [.[] | select(.name == \"$old\")]) | .[0].id // empty")"
+    # Sinon, un ancien ruleset sous un autre nom couvrant ses branches : repris
+    # (mis à jour en place, jamais un instant sans protection)
+    repris=""
+    if [ -z "$id" ] && grep -q '"target": "branch"' <<<"$ruleset"; then
+        while IFS= read -r ligne; do
+            { [ -n "$ligne" ] && couvre "$ligne" "$ruleset"; } || continue
+            id="${ligne%%$'\t'*}"
+            repris="$(cut -f2 <<<"$ligne")"
+            ANCIENS="$(grep -v "^$id"$'\t' <<<"$ANCIENS" || true)"
+            break
+        done <<<"$ANCIENS"
+    fi
     if [ -n "$id" ]; then
-        gh api -X PUT "repos/$REPO/rulesets/$id" --input - <<<"$ruleset" >/dev/null
-        ok_t ci.proteger.10 "$name"
+        methode=PUT chemin="repos/$REPO/rulesets/$id"
+    else
+        methode=POST chemin="repos/$REPO/rulesets"
+    fi
+    # Réponse gardée : en cas de refus, le détail de GitHub est affiché
+    if reponse="$(gh api -X "$methode" "$chemin" --input - <<<"$ruleset" 2>&1)"; then
+        if [ -n "$repris" ]; then
+            ok_t ci.proteger.legacy_taken "$name" "$repris"
+        elif [ -n "$id" ]; then
+            ok_t ci.proteger.10 "$name"
+        else
+            ok_t ci.proteger.11 "$name"
+        fi
+    elif [ "$name" = "repowarden (tags)" ] && [ "$owner_type" = Organization ] &&
+        [[ "$reponse" == *"ruleset source or owner organization"* ]] &&
+        gh api -X "$methode" "$chemin" --input - <<<"$(tags_ruleset User)" >/dev/null 2>&1; then
+        # Exception GitHub Actions refusée (App non installée dans l'organisation) :
+        # règle des comptes personnels, tags ni déplacés ni supprimés
+        attention_t ci.proteger.tags_fallback
     else
-        gh api -X POST "repos/$REPO/rulesets" --input - <<<"$ruleset" >/dev/null
-        ok_t ci.proteger.11 "$name"
+        erreur_github "$reponse"
+        err_t ci.proteger.api_error "$name" "$REPLY"
+        echecs=$((echecs + 1))
     fi
 done
+# Anciens rulesets non repris (plusieurs sur les mêmes branches) : jamais
+# supprimés ici, la marche à suivre est donnée
+while IFS=$'\t' read -r id name _; do
+    [ -n "$id" ] || continue
+    err_t ci.proteger.legacy_left "$name" "$id" "$REPO" "$id"
+    echecs=$((echecs + 1))
+done <<<"$ANCIENS"
 if [ -n "$env_json" ]; then
     gh api -X PUT "repos/$REPO/environments/$ENVIRONMENT" --input - --silent <<<"$env_json"
     policies="$(gh api "repos/$REPO/environments/$ENVIRONMENT/deployment-branch-policies" \
@@ -389,4 +509,5 @@ if [ -n "$env_json" ]; then
 fi
 [ -z "$urgent" ] || gh label create urgent -R "$REPO" --color B60205 \
     --description "Livraison immédiate après merge" >/dev/null
+[ "$echecs" = 0 ] || { err_t ci.proteger.incomplete; exit 1; }
 ok_t ci.proteger.13

package/bin/repowarden

@@ -3,6 +3,7 @@
 #   repowarden                                     état du poste et étape suivante
 #   repowarden statut                              (idem)
 #   repowarden install [--global] [--lang fr|en]   active les hooks (install.sh)
+#   repowarden bots                                bots du dépôt GitHub (CI, releases, tickets…)
 #   repowarden uninstall [--global] [--purge]      les retire (avant npm uninstall -g)
 #   repowarden cc                                  assistant de commit
 #   repowarden code-mort                           nouveau code mort de la branche
@@ -16,8 +17,10 @@
 #   repowarden run list [--workflow <nom>]        liste les runs récents
 #   repowarden tickets init                        suivi des tickets (GitHub)
 #   repowarden proteger [options]                  protection des branches (GitHub)
+#   repowarden migrer [--pr] [--hooks]             passage de repogarde à repowarden
 #   repowarden npm-publication                     publication npm automatique
 #   repowarden app init                            GitHub App des workflows (une fois)
+#   repowarden bot [init|rapport]                  bot d'organisation (dépôt de pilotage)
 #   repowarden --version
 set -euo pipefail
 
@@ -35,7 +38,7 @@ source "$ROOT/hooks/lib/ui.sh"
 # shellcheck source=../hooks/lib/i18n.sh
 source "$ROOT/hooks/lib/i18n.sh"
 
-aide() { sed -n '2,21p' "$ROOT/bin/repowarden" | sed 's/^# \{0,1\}//'; }
+aide() { sed -n '2,24p' "$ROOT/bin/repowarden" | sed 's/^# \{0,1\}//'; }
 
 commande="${1:-}"
 [ $# -eq 0 ] || shift
@@ -61,8 +64,11 @@ case "$commande" in
     run-list) exec bash "$ROOT/bin/run-list" "$@" ;;
     pr-checks) exec bash "$ROOT/bin/pr-checks" "$@" ;;
     proteger | protect) exec bash "$ROOT/bin/proteger" "$@" ;;
+    migrer | migrate) exec bash "$ROOT/bin/migrer" "$@" ;;
     npm-publication | npm-publish) exec bash "$ROOT/bin/npm-publication" "$@" ;;
     app) exec bash "$ROOT/bin/app" "$@" ;;
+    bots) exec bash "$ROOT/bin/bots" "$@" ;;
+    bot) exec bash "$ROOT/bin/bot" "$@" ;;
     -v | --version | version)
         repowarden_version_r "$ROOT"
         echo "$REPLY"

package/bin/statut

@@ -70,6 +70,18 @@ if [ -n "$GIT_TOPLEVEL" ]; then
         attention_t st.repo_lefthook "$f"
         break
     done
+    # Anciens noms (configuration, workflows de l'ancien dépôt, que GitHub ne
+    # redirige plus) : la migration les remplace
+    if [ -e "$GIT_TOPLEVEL/.repogarde.conf" ] || [ -d "$GIT_TOPLEVEL/.repogarde" ] ||
+        grep -qs repogarde "$GIT_TOPLEVEL"/.github/workflows/*.y*ml; then
+        attention_t st.repo_migrate
+        suivant="${suivant:-repowarden migrer}"
+    fi
+    # Branche develop présente, flux non déclaré : traité comme « main seule »
+    cfg_r integrationBranch ""
+    if [ -z "$REPLY" ] && git rev-parse -q --verify refs/remotes/origin/develop >/dev/null; then
+        attention_t st.repo_develop_undeclared
+    fi
     cfg_r version ""
     if [ -n "$REPLY" ]; then
         attendue="${REPLY#v}"

package/bin/tickets

@@ -141,13 +141,11 @@ GH_REPO="$REPO" AUTO_VALIDATE="${AUTO_VALIDATE:-maintainers}" "$ROOT/ci/tickets.
 
 # Afficher l'état de ticketAutoCreate
 echo
-if git config --get repowarden.ticketAutoCreate | grep -qE '^(true|oui|yes)$'; then
-    t tk.init_auto_create_on
-    hint "$_T"
-else
-    t tk.init_auto_create_off
-    hint "$_T"
-fi
+cfg_r ticketAutoCreate false
+case "$REPLY" in
+    true | oui | yes) dim_t tk.init_auto_create_on ;;
+    *) dim_t tk.init_auto_create_off ;;
+esac
 
 echo
 ok_t tk.init_done

package/hooks/lib/i18n/en.sh

@@ -100,6 +100,7 @@ _msg_en() {
         install.replaced) _M="core.hooksPath (%s) was '%s', replaced." ;;
         install.enabled) _M="Hooks enabled (%s) → %s" ;;
         install.local_wins) _M="A local core.hooksPath (e.g. husky) still takes precedence in that repository." ;;
+        install.bots_never) _M="Repository bots will no longer be offered (repowarden.bots = off); on demand: repowarden bots" ;;
         install.lang_set) _M="Message language: English (change: %s --global --lang fr)" ;;
         install.lang_invalid) _M="--lang: fr or en." ;;
         install.keys_migrated) _M="repogarde.* settings (%s) renamed to repowarden.*" ;;
@@ -232,6 +233,7 @@ _msg_en() {
         ci.check.16) _M="Target \"%s\" matches the flow." ;;
         ci.check.17) _M="PR from \"%s\" to \"%s\": expected target %s (integrationBranch setting)." ;;
         ci.check.18) _M="  Fix: change the PR base branch (Edit, next to the title), or gh pr edit --base %s" ;;
+        ci.check.develop_undeclared) _M="PR %s → %s: the develop branch exists but .repowarden.conf does not declare the develop → main flow. Add integrationBranch = develop (work then goes through develop), or delete develop if the project does not want it." ;;
         ci.check.19) _M="gitleaks not installed: run ci/install-tool.sh gitleaks before this script." ;;
         ci.check.20) _M="Working tree modified before the check: formatting cannot be verified." ;;
         ci.check.21) _M="A formatter failed (syntax error, or tool / dependency unavailable): see the log above." ;;
@@ -296,16 +298,57 @@ _msg_en() {
         ci.proteger.verify_ok) _M="Online rules up to date." ;;
         ci.proteger.delivery) _M="  delivery into main: %s approval(s) required (moving to a new version); auto-merge of work PRs into develop: %s" ;;
         ci.proteger.methods_flow) _M="main: merge commit; %s: squash or merge commit" ;;
+        ci.proteger.livraison_check) _M="  \"livraison\" check required on the main branch (prerelease published, protection in place)" ;;
         ci.proteger.tags_org) _M="reserved for workflows" ;;
         ci.proteger.tags_user) _M="neither moved nor deleted (personal account: creation allowed)" ;;
         ci.proteger.tags_none) _M="not protected (--sans-tags)" ;;
         ci.proteger.unknown_team) _M="Unknown or inaccessible team: %s (format @organisation/team)" ;;
         ci.proteger.unknown_user) _M="Unknown user: %s" ;;
-        ci.version.usage) _M="Usage: ci/version.sh next|notes [ref]" ;;
+        mig.no_major) _M="repowarden major version not found (%s): REPOWARDEN_MAJEURE=4 repowarden migrer." ;;
+        mig.dirty) _M="Uncommitted changes: commit or stash before repowarden migrer --pr." ;;
+        mig.pr_open) _M="Migration PR already open (%s): nothing to do." ;;
+        mig.both) _M="%s and %s both exist: keep the second, merge then delete the first by hand." ;;
+        mig.conf) _M=".repogarde.conf → .repowarden.conf ([repowarden] section, version updated)" ;;
+        mig.dir) _M=".repogarde/ → .repowarden/" ;;
+        mig.workflow) _M="%s: uses: to simdevWarden/repowarden, old names replaced" ;;
+        mig.renamed) _M="%s → %s" ;;
+        mig.tickets_events) _M="%s: ticket tracking events completed (push, review, assignment, closing): prefilled draft PR on the first push" ;;
+        mig.tickets_labels) _M="Tracking labels (type: feat, statuses…): repowarden tickets init (can be rerun, rewrites no file)" ;;
+        mig.hooks_moved) _M="Leftover lefthook hooks (%s) moved to %s" ;;
+        mig.hooks_left) _M="Leftover lefthook hooks in .git/hooks (%s), ignored: repowarden migrer --hooks to set them aside." ;;
+        mig.lefthook_conf) _M="%s: lefthook is no longer supported; move its commands to .repowarden/<hook>, then delete this file." ;;
+        mig.secrets) _M="Secrets or variables renamed in the workflows, to recreate under the new name (Settings → Secrets and variables):%s" ;;
+        mig.remaining) _M="Still mention repogarde (to review, not changed): %s" ;;
+        mig.nothing) _M="Nothing to migrate: the project already uses the repowarden names." ;;
+        mig.next) _M="Next: check the diff, then repowarden proteger (the required check is now called repowarden)." ;;
+        mig.commit_subject) _M="move from repogarde to repowarden v%s" ;;
+        mig.commit_body) _M="Old names and paths replaced by repowarden migrer (docs/migration-v4.md): GitHub no longer redirects the old repository's reusable workflows." ;;
+        mig.pr_body) _M="Migration from repogarde to repowarden, made by repowarden migrer (docs/migration-v4.md)." ;;
+        mig.pr_after) _M="After merging: run repowarden proteger (the required check is now called repowarden) and recreate any REPOGARDE_* secrets under their new name." ;;
+        mig.pr_created) _M="Migration PR opened (%s)." ;;
+        st.repo_migrate) _M="Old repogarde names in this project: repowarden migrer" ;;
+        st.repo_develop_undeclared) _M="The develop branch exists but the develop → main flow is not declared: add integrationBranch = develop to .repowarden.conf (otherwise work can go straight into main)." ;;
+        ci.proteger.legacy_taken) _M="Ruleset \"%s\": old ruleset \"%s\" taken over (repogarde check removed)." ;;
+        ci.proteger.legacy_left) _M="Old ruleset \"%s\" (id %s): still requires the repogarde check, removed in v4, and blocks its branches. Delete it: Settings → Rules → Rulesets, or gh api -X DELETE repos/%s/rulesets/%s." ;;
+        ci.proteger.verify_legacy) _M="%s (id %s): old ruleset, still requires the repogarde check (removed in v4)" ;;
+        ci.proteger.api_error) _M="Ruleset \"%s\" rejected by GitHub: %s" ;;
+        ci.proteger.incomplete) _M="Incomplete protection: see the errors above." ;;
+        ci.proteger.rulesets_unavailable) _M="Rulesets unavailable for %s: GitHub refuses them on a private repository of a free account. Make the repository public, or move to GitHub Pro / Team; the other settings are applied." ;;
+        ci.proteger.tags_fallback) _M="Tags ruleset: \"GitHub Actions\" bypass refused in this organization; tags protected as on a personal account (not moved or deleted, creation allowed)." ;;
+        ci.version.usage) _M="Usage: ci/version.sh next|notes|notes-livraison [ref]" ;;
         ci.version.breaking) _M="Breaking changes" ;;
         ci.version.features) _M="Features" ;;
         ci.version.fixes) _M="Bug fixes" ;;
         ci.version.maintenance) _M="Maintenance" ;;
+        ci.version.summary) _M="In short" ;;
+        ci.version.todo) _M="To do" ;;
+        ci.version.update) _M="Update" ;;
+        ci.version.tickets) _M="Delivered tickets" ;;
+        ci.livraison.protection) _M="Protection of the %s flow missing (merge commit, no deletion): run repowarden proteger" ;;
+        ci.livraison.maintenance) _M="Maintenance only: no version to publish" ;;
+        ci.livraison.non_exigee) _M="%s: prerelease not required" ;;
+        ci.livraison.ok) _M="%s: prerelease tested, deliverable" ;;
+        ci.livraison.preversion) _M="%s: no prerelease %s; wait for the evening one, or Actions → release → Run workflow on %s" ;;
         ci.install_tool.os) _M="Unsupported system: %s" ;;
         ci.install_tool.arch) _M="Unsupported architecture: %s" ;;
         ci.install_tool.unknown) _M="Unknown tool: %s" ;;
@@ -360,7 +403,16 @@ _msg_en() {
         npm.first_published) _M="%s@%s published by the pipeline." ;;
         npm.step_trust) _M="3/3 Tokenless publishing (trusted publishing)" ;;
         npm.trust_exists) _M="Trusted publishing already configured." ;;
+        npm.trust_mismatch) _M="Existing trust relationship does not match expected parameters:" ;;
+        npm.trust_confirm) _M="Confirm fix (new relationship created before revoking old)? [y/N] " ;;
+        npm.trust_cancelled) _M="Fix cancelled." ;;
+        npm.trust_would_create) _M="[dry-run] Trust relationship would be created: %s, workflow %s, env %s" ;;
+        npm.trust_would_fix) _M="[dry-run] Trust relationship would be fixed (new created, old revoked)" ;;
+        npm.trust_revoked) _M="Old trust relationship revoked: %s" ;;
         npm.trust_set) _M="Trusted publishing: %s, workflow %s." ;;
+        npm.token_present) _M="NPM_TOKEN secret still present while trusted publishing works." ;;
+        npm.token_remove_confirm) _M="Remove NPM_TOKEN secret? [y/N] " ;;
+        npm.token_would_remove) _M="[dry-run] NPM_TOKEN secret would be removed" ;;
         npm.token_removed) _M="NPM_TOKEN secret removed from the repository." ;;
         npm.token_revoked) _M="Temporary token revoked on npm." ;;
         npm.done) _M="Done: every release publishes %s to npm, without a token." ;;
@@ -406,13 +458,93 @@ _msg_en() {
         app.server_failed) _M="Local page did not start." ;;
         app.open) _M="Open %s then click GitHub's green button." ;;
         app.no_code) _M="No answer from GitHub (creation cancelled, or 15 min timeout)." ;;
-        app.created) _M="App %s created; credentials stored (variable REPOWARDEN_APP_CLIENT_ID, secret REPOWARDEN_APP_KEY)." ;;
+        app.created) _M="App %s created; credentials stored (variable %s, secret %s)." ;;
         app.step_install) _M="Installing on the repository" ;;
         app.installed) _M="App %s installed on %s." ;;
         app.not_installed) _M="App %s not installed on %s yet: run repowarden app init again once installed." ;;
         app.check_in_ci) _M="Installation checked by the first ticket tracking run (\"Jeton de l'App\" step); to install it: %s" ;;
         app.done) _M="repowarden workflows now use the App: what they do triggers the other workflows." ;;
         app.next) _M="Without the App (variable and secret missing), they fall back to the Actions token." ;;
+        app.bot_all_repos) _M="Organization bot: when installing, choose \"All repositories\" (new repositories are covered automatically; only those with a .repowarden.conf are managed)." ;;
+        bot.init_exists) _M="%s already exists: left unchanged." ;;
+        bot.init_done) _M="%s written: runs every night, and on demand (Actions → bot → Run workflow, dry-run box to see without changing anything)." ;;
+        bot.init_next) _M="Bot credentials in this repository: repowarden app init --bot (once, installed on \"All repositories\")." ;;
+        bot.no_report) _M="Report not found: %s" ;;
+        bot.report_updated) _M="Report published (issue #%s updated)." ;;
+        bot.report_created) _M="Report published (new issue)." ;;
+        bot.col_repo) _M="Repository" ;;
+        bot.col_mode) _M="Mode" ;;
+        bot.col_protection) _M="Protection" ;;
+        bot.col_migration) _M="Migration" ;;
+        bot.repo) _M="%s" ;;
+        bot.not_adopted) _M="not adopted (no .repowarden.conf)" ;;
+        bot.ignored) _M="ignored (bot = off)" ;;
+        bot.mode_invalid) _M="bot = %s: auto, pr or off expected" ;;
+        bot.clone_failed) _M="clone failed: %s" ;;
+        bot.prot_ok) _M="up to date" ;;
+        bot.prot_stale) _M="⚠ outdated: repowarden proteger" ;;
+        bot.prot_applied) _M="✔ applied" ;;
+        bot.error) _M="✖ %s" ;;
+        bot.mig_none) _M="nothing to migrate" ;;
+        bot.mig_open) _M="PR already open" ;;
+        bot.mig_todo) _M="⚠ to migrate: repowarden migrer" ;;
+        bot.mig_pr) _M="✔ PR opened" ;;
+        bot.report_head) _M="Run of %s." ;;
+        bot.report_dry) _M="Preview (dry-run): nothing was changed." ;;
+        bot.failed) _M="Run finished with %s error(s): see the report." ;;
+        bots.skip) _M="Repository bots not offered (%s): later, repowarden bots" ;;
+        bots.why_repo) _M="not in a Git repository" ;;
+        bots.why_github) _M="repository not on GitHub" ;;
+        bots.why_gh) _M="gh missing: https://cli.github.com" ;;
+        bots.why_gh_login) _M="gh not logged in: gh auth login" ;;
+        bots.why_admin) _M="repository admin rights needed" ;;
+        bots.why_tty) _M="no terminal to answer the questions" ;;
+        bots.ask_global) _M="Set up this repository's bots (CI, releases, tickets, protection…)? Nothing is done without your consent, bot by bot." ;;
+        bots.later) _M="No bot set up. Later: repowarden bots" ;;
+        bots.flow_question) _M="Branch flow:" ;;
+        bots.flow_main) _M="%s only: every PR is merged into it (squash)" ;;
+        bots.flow_develop) _M="develop → %s: work is integrated into develop (prereleases), only develop goes into %s (delivery)" ;;
+        bots.ask_create_develop) _M="The develop branch does not exist on GitHub: create it from the default branch?" ;;
+        bots.one_by_one) _M="One consent per bot (Enter: yes):" ;;
+        bots.app_present) _M="Workflows GitHub App already set up: used by the other bots." ;;
+        bots.desc_ci) _M="  CI: checks every PR (messages, branch, secrets, formatting, tests); writes .github/workflows/repowarden.yml" ;;
+        bots.desc_release) _M="  Releases: version, notes and tag computed from the commits; writes .github/workflows/release.yml" ;;
+        bots.desc_nettoyage) _M="  Cleanup: deletes merged branches, keeps long-lived branches; writes .github/workflows/nettoyage.yml" ;;
+        bots.desc_tickets) _M="  Tickets: ticket first, prefilled PR, statuses up to production; labels, ticket template, workflow (repowarden tickets init)" ;;
+        bots.desc_app) _M="  GitHub App: what the bots do triggers the other workflows; created in the browser (repowarden app init)" ;;
+        bots.desc_proteger) _M="  Protection: PR and checks required, no deletion or force push; changes GitHub settings (repowarden proteger)" ;;
+        bots.desc_npm) _M="  npm: publishes the package on every release, without a token (repowarden npm-publication)" ;;
+        bots.ask_ci) _M="CI?" ;;
+        bots.ask_release) _M="Releases?" ;;
+        bots.ask_nettoyage) _M="Branch cleanup?" ;;
+        bots.ask_tickets) _M="Ticket tracking?" ;;
+        bots.ask_app) _M="GitHub App?" ;;
+        bots.ask_proteger) _M="Branch protection?" ;;
+        bots.ask_npm) _M="npm publishing?" ;;
+        bots.preview) _M="Preview" ;;
+        bots.prev_develop) _M="branch %s created on GitHub from %s" ;;
+        bots.prev_conf) _M=".repowarden.conf: integrationBranch = %s, protected branches" ;;
+        bots.prev_review) _M=".repowarden.conf: delivery approved by reviewing its PR (no GitHub App)" ;;
+        bots.prev_kept) _M="%s exists: kept as is (difference with the template: %s line(s))" ;;
+        bots.prev_file) _M="%s: created" ;;
+        bots.prev_tickets) _M="tickets: labels and ticket template on GitHub, tickets.yml workflow" ;;
+        bots.prev_app) _M="GitHub App: created in the browser, credentials stored as repository variable and secret" ;;
+        bots.prev_proteger) _M="GitHub settings: branch and tag rulesets, merge methods" ;;
+        bots.prev_npm) _M="npm: trusted publishing of the package, REPOWARDEN_NPM variable" ;;
+        bots.ask_confirm) _M="Apply?" ;;
+        bots.run_tickets) _M="Ticket tracking" ;;
+        bots.run_app) _M="GitHub App" ;;
+        bots.run_proteger) _M="Branch protection" ;;
+        bots.run_npm) _M="npm publishing" ;;
+        bots.failed_one) _M="%s: failed, see above; the other bots are set up. Run again: repowarden bots" ;;
+        bots.develop_created) _M="Branch %s created from %s." ;;
+        bots.conf_written) _M="%s updated." ;;
+        bots.kept) _M="%s exists: kept as is." ;;
+        bots.written) _M="%s written." ;;
+        bots.done) _M="Bots set up." ;;
+        bots.done_errors) _M="Bots set up, %s failed (see above)." ;;
+        bots.commit_files) _M="Files to commit through a PR (workflows act once on the default branch): git status" ;;
+        bots.verify) _M="Then: repowarden proteger --verifier, and repowarden statut." ;;
         tk.reopened) _M="Reopened: closed by GitHub when #%s was merged into \`%s\`, which is not production yet. In pre-production; it will be closed at the release." ;;
         tk.sync.ready) _M="Ticket #%s assigned: local branch %s ready (repowarden ticket %s)." ;;
         tk.sync.not_validated) _M="Ticket #%s assigned but not validated yet: no branch for now." ;;