diff --git a/.github/workflows/dependabot-auto-merge.yml b/.github/workflows/dependabot-auto-merge.yml index 654e8a3..a44f35b 100644 --- a/.github/workflows/dependabot-auto-merge.yml +++ b/.github/workflows/dependabot-auto-merge.yml @@ -47,7 +47,9 @@ jobs: uses: CLDMV/.github/.github/workflows/reusable-dependabot-auto-merge.yml@v4 with: bump_types: "patch,minor" - merge_method: "squash" + # merge_method defaults to "merge" β€” Dependabot PRs target next / hotfixes, + # whose rulesets are merge-only. Override only if your branches differ. + # merge_method: "merge" # also_for_actors: "renovate[bot]" # extend if you adopt Renovate secrets: BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} diff --git a/.github/workflows/hotfixes-release.yml b/.github/workflows/hotfixes-release.yml index eee6f79..5dfa95e 100644 --- a/.github/workflows/hotfixes-release.yml +++ b/.github/workflows/hotfixes-release.yml @@ -1,7 +1,7 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/release-flow-v4/hotfixes-release.yml -# @Date: 2026-05-22 00:00:00 -07:00 (1779778800) +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/hotfixes-release.yml +# @Date: 2026-07-13 07:27:41 -07:00 (1783952861) # @Author: Nate Corcoran # @Email: # @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved. @@ -24,6 +24,7 @@ name: πŸš‘ Hotfixes Release (v4) on: push: branches: [hotfixes] + workflow_dispatch: # manual kick β€” e.g. to open/refresh the PR for content already on `hotfixes` permissions: contents: write @@ -35,11 +36,15 @@ concurrency: jobs: plan: - # Loop guard: skip the bot's own chore-bump pushes and reset pushes. - # Replace `cldmv-bot[bot]` with your bot App's login if different. + # Loop guard: skip only the release machinery's own `chore: bump version` + # push (create/update-release-pr writes it back to `hotfixes`). Do NOT gate + # on github.actor β€” dependabot security PRs are auto-merged into `hotfixes` + # BY the bot, so gating the bot out meant the hotfixesβ†’master release PR + # was never created (every push here is a bot merge). Reset force-pushes are + # harmless: the detect step below no-ops when in sync with master. + # workflow_dispatch bypasses the guard (event_name != 'push'). if: | - github.actor != 'cldmv-bot[bot]' && - github.actor != 'github-actions[bot]' && + github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') name: "πŸ” Plan (detect changes + resolve PR)" runs-on: ubuntu-latest diff --git a/.github/workflows/master-commit-audit.yml b/.github/workflows/master-commit-audit.yml index 4be375f..a3a15df 100644 --- a/.github/workflows/master-commit-audit.yml +++ b/.github/workflows/master-commit-audit.yml @@ -1,7 +1,7 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/release-companions/master-commit-audit.yml -# @Date: 2026-05-20 00:00:00 -07:00 (1779606000) +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/master-commit-audit.yml +# @Date: 2026-07-13 07:27:41 -07:00 (1783952861) # @Author: Nate Corcoran # @Email: # @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved. @@ -10,14 +10,16 @@ # Individual repo: .github/workflows/master-commit-audit.yml # # Post-merge safety net: when any commit lands on the default branch, verify -# its subject matches the expected release-flow patterns. On miss, auto-file -# a GitHub Issue (deduped by SHA) so the alert is persistent and assignable -# β€” not just a red ❌ that dies in inbox. +# its subject matches the expected release-flow patterns. On miss, auto-file a +# GitHub Issue (deduped by SHA) so the alert is persistent and assignable β€” +# not just a red ❌ that dies in inbox. # # Catches: release-workflow title-generation regressions, branch-protection # bypasses, unexpected bot commits, direct emergency pushes. # -# Batch 5.1 from tmp/plan-future-workflows.md. +# Thin caller: steps, the action ref, and the canonical commit-subject pattern +# set all live in reusable-master-commit-audit.yml@v4 (the patterns come from +# the audit-commit-subject action's default). Nothing here can drift. name: 🧾 Master Commit Audit on: @@ -30,34 +32,21 @@ permissions: jobs: audit: - runs-on: ubuntu-latest - steps: - # Optional. Without these, the audit issue is filed by - # github-actions[bot]. With them, the issue is filed by your bot App. - - name: Create App token (falls back to GITHUB_TOKEN) - id: app-token - uses: CLDMV/.github/.github/actions/github/steps/create-app-token@v4 - with: - client_id: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - private_key: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} - env: - BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} - BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} - - - name: Audit commit subject - uses: CLDMV/.github/.github/actions/git/jobs/audit-commit-subject@v4 - with: - commit_sha: ${{ github.sha }} - # Allow release commits (from the release workflow), maintenance - # commits, and standard merge commits. Customize per repo if - # your conventions differ. - allowed_patterns: | - ^release: v\d+\.\d+\.\d+( \(#\d+\))?$ - ^chore(\([^)]+\))?: .+ - ^Merge pull request #\d+ from .+ - # Canonical label names from CLDMV/.github's data/github-labels.json - # (note the space after each colon). Replace with names that exist - # in your repo's label catalog. - issue_labels: "type: ci,priority: high" - # issue_assignee: "shinrai" # uncomment to auto-assign - github_token: ${{ steps.app-token.outputs.token }} + uses: CLDMV/.github/.github/workflows/reusable-master-commit-audit.yml@v4 + with: + # allowed_patterns omitted β†’ inherit the canonical default + # (release + chore + merge). Uncomment ONLY if this repo lands other + # commit shapes directly on the default branch: + # allowed_patterns: | + # ^release: v\d+\.\d+\.\d+( - .+?)?( \(#\d+\))?$ + # ^chore(\([^)]+\))?: .+ + # ^Merge pull request #\d+ from .+ + # ^feat(\([^)]+\))?: .+ + issue_labels: "type: ci,priority: high" + # issue_assignee: "shinrai" # uncomment to auto-assign + # Optional bot App credentials β€” when set, the audit issue is filed by + # the consumer's bot App instead of github-actions[bot]. Remove both + # lines to fall back to GITHUB_TOKEN. + secrets: + BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }} + BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }} diff --git a/.github/workflows/next-release.yml b/.github/workflows/next-release.yml index 915b5d7..8bba316 100644 --- a/.github/workflows/next-release.yml +++ b/.github/workflows/next-release.yml @@ -1,7 +1,7 @@ # -# @Project: @cldmv/.github -# @Filename: /examples/individual-repo-workflows/release-flow-v4/next-release.yml -# @Date: 2026-05-22 00:00:00 -07:00 (1779778800) +# @Project: @cldmv/git-embedded +# @Filename: /.github/workflows/next-release.yml +# @Date: 2026-07-13 07:27:41 -07:00 (1783952861) # @Author: Nate Corcoran # @Email: # @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved. @@ -26,6 +26,7 @@ name: πŸš€ Next Release (v4) on: push: branches: [next] + workflow_dispatch: # manual kick β€” e.g. to open/refresh the PR for content already on `next` permissions: contents: write @@ -39,13 +40,15 @@ concurrency: jobs: plan: - # Loop guard: the refresh/create steps push a `chore: bump version` - # commit to `next` (as the bot), and next-reset.yml force-pushes - # `next` (as the bot). Neither should re-trigger a release-PR refresh. - # Replace `cldmv-bot[bot]` with your bot App's login if different. + # Loop guard: skip only the release machinery's own `chore: bump version` + # push (create/update-release-pr writes it back to `next`). Do NOT gate on + # github.actor β€” dependabot security PRs are auto-merged BY the bot, and + # excluding the bot actor meant bot-merged PRs never refreshed the release + # PR (fatal on `hotfixes`, where every merge is a bot auto-merge). Reset + # force-pushes are harmless: the detect step below no-ops when in sync with + # master. workflow_dispatch bypasses the guard (event_name != 'push'). if: | - github.actor != 'cldmv-bot[bot]' && - github.actor != 'github-actions[bot]' && + github.event_name != 'push' || !startsWith(github.event.head_commit.message, 'chore: bump version') name: "πŸ” Plan (detect changes + resolve PR)" runs-on: ubuntu-latest