ci: sync stale workflow copies with current CLDMV/.github templates

.github/workflows/dependabot-auto-merge.yml

@@ -47,7 +47,9 @@ jobs:
         uses: CLDMV/.github/.github/workflows/reusable-dependabot-auto-merge.yml@v4
         with:
             bump_types: "patch,minor"
-            merge_method: "squash"
+            # merge_method defaults to "merge" — Dependabot PRs target next / hotfixes,
+            # whose rulesets are merge-only. Override only if your branches differ.
+            # merge_method: "merge"
             # also_for_actors: "renovate[bot]"   # extend if you adopt Renovate
         secrets:
             BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}

.github/workflows/hotfixes-release.yml

@@ -1,7 +1,7 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/release-flow-v4/hotfixes-release.yml
-# @Date: 2026-05-22 00:00:00 -07:00 (1779778800)
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/hotfixes-release.yml
+# @Date: 2026-07-13 07:27:41 -07:00 (1783952861)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>
 # @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
@@ -24,6 +24,7 @@ name: 🚑 Hotfixes Release (v4)
 on:
     push:
         branches: [hotfixes]
+    workflow_dispatch: # manual kick — e.g. to open/refresh the PR for content already on `hotfixes`
 
 permissions:
     contents: write
@@ -35,11 +36,15 @@ concurrency:
 
 jobs:
     plan:
-        # Loop guard: skip the bot's own chore-bump pushes and reset pushes.
-        # Replace `cldmv-bot[bot]` with your bot App's login if different.
+        # Loop guard: skip only the release machinery's own `chore: bump version`
+        # push (create/update-release-pr writes it back to `hotfixes`). Do NOT gate
+        # on github.actor — dependabot security PRs are auto-merged into `hotfixes`
+        # BY the bot, so gating the bot out meant the hotfixes→master release PR
+        # was never created (every push here is a bot merge). Reset force-pushes are
+        # harmless: the detect step below no-ops when in sync with master.
+        # workflow_dispatch bypasses the guard (event_name != 'push').
         if: |
-            github.actor != 'cldmv-bot[bot]' &&
-            github.actor != 'github-actions[bot]' &&
+            github.event_name != 'push' ||
             !startsWith(github.event.head_commit.message, 'chore: bump version')
         name: "🔍 Plan (detect changes + resolve PR)"
         runs-on: ubuntu-latest

.github/workflows/master-commit-audit.yml

@@ -1,7 +1,7 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/release-companions/master-commit-audit.yml
-# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/master-commit-audit.yml
+# @Date: 2026-07-13 07:27:41 -07:00 (1783952861)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>
 # @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
@@ -10,14 +10,16 @@
 # Individual repo: .github/workflows/master-commit-audit.yml
 #
 # Post-merge safety net: when any commit lands on the default branch, verify
-# its subject matches the expected release-flow patterns. On miss, auto-file
-# a GitHub Issue (deduped by SHA) so the alert is persistent and assignable
-# — not just a red ❌ that dies in inbox.
+# its subject matches the expected release-flow patterns. On miss, auto-file a
+# GitHub Issue (deduped by SHA) so the alert is persistent and assignable —
+# not just a red ❌ that dies in inbox.
 #
 # Catches: release-workflow title-generation regressions, branch-protection
 # bypasses, unexpected bot commits, direct emergency pushes.
 #
-# Batch 5.1 from tmp/plan-future-workflows.md.
+# Thin caller: steps, the action ref, and the canonical commit-subject pattern
+# set all live in reusable-master-commit-audit.yml@v4 (the patterns come from
+# the audit-commit-subject action's default). Nothing here can drift.
 name: 🧾 Master Commit Audit
 
 on:
@@ -30,34 +32,21 @@ permissions:
 
 jobs:
     audit:
-        runs-on: ubuntu-latest
-        steps:
-            # Optional. Without these, the audit issue is filed by
-            # github-actions[bot]. With them, the issue is filed by your bot App.
-            - name: Create App token (falls back to GITHUB_TOKEN)
-              id: app-token
-              uses: CLDMV/.github/.github/actions/github/steps/create-app-token@v4
-              with:
-                  client_id: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-                  private_key: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
-              env:
-                  BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
-                  BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
-
-            - name: Audit commit subject
-              uses: CLDMV/.github/.github/actions/git/jobs/audit-commit-subject@v4
-              with:
-                  commit_sha: ${{ github.sha }}
-                  # Allow release commits (from the release workflow), maintenance
-                  # commits, and standard merge commits. Customize per repo if
-                  # your conventions differ.
-                  allowed_patterns: |
-                      ^release: v\d+\.\d+\.\d+( \(#\d+\))?$
-                      ^chore(\([^)]+\))?: .+
-                      ^Merge pull request #\d+ from .+
-                  # Canonical label names from CLDMV/.github's data/github-labels.json
-                  # (note the space after each colon). Replace with names that exist
-                  # in your repo's label catalog.
-                  issue_labels: "type: ci,priority: high"
-                  # issue_assignee: "shinrai"   # uncomment to auto-assign
-                  github_token: ${{ steps.app-token.outputs.token }}
+        uses: CLDMV/.github/.github/workflows/reusable-master-commit-audit.yml@v4
+        with:
+            # allowed_patterns omitted → inherit the canonical default
+            # (release + chore + merge). Uncomment ONLY if this repo lands other
+            # commit shapes directly on the default branch:
+            # allowed_patterns: |
+            #     ^release: v\d+\.\d+\.\d+( - .+?)?( \(#\d+\))?$
+            #     ^chore(\([^)]+\))?: .+
+            #     ^Merge pull request #\d+ from .+
+            #     ^feat(\([^)]+\))?: .+
+            issue_labels: "type: ci,priority: high"
+            # issue_assignee: "shinrai"   # uncomment to auto-assign
+        # Optional bot App credentials — when set, the audit issue is filed by
+        # the consumer's bot App instead of github-actions[bot]. Remove both
+        # lines to fall back to GITHUB_TOKEN.
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

.github/workflows/next-release.yml

@@ -1,7 +1,7 @@
 #
-# @Project: @cldmv/.github
-# @Filename: /examples/individual-repo-workflows/release-flow-v4/next-release.yml
-# @Date: 2026-05-22 00:00:00 -07:00 (1779778800)
+# @Project: @cldmv/git-embedded
+# @Filename: /.github/workflows/next-release.yml
+# @Date: 2026-07-13 07:27:41 -07:00 (1783952861)
 # @Author: Nate Corcoran <CLDMV>
 # @Email: <Shinrai@users.noreply.github.com>
 # @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
@@ -26,6 +26,7 @@ name: 🚀 Next Release (v4)
 on:
     push:
         branches: [next]
+    workflow_dispatch: # manual kick — e.g. to open/refresh the PR for content already on `next`
 
 permissions:
     contents: write
@@ -39,13 +40,15 @@ concurrency:
 
 jobs:
     plan:
-        # Loop guard: the refresh/create steps push a `chore: bump version`
-        # commit to `next` (as the bot), and next-reset.yml force-pushes
-        # `next` (as the bot). Neither should re-trigger a release-PR refresh.
-        # Replace `cldmv-bot[bot]` with your bot App's login if different.
+        # Loop guard: skip only the release machinery's own `chore: bump version`
+        # push (create/update-release-pr writes it back to `next`). Do NOT gate on
+        # github.actor — dependabot security PRs are auto-merged BY the bot, and
+        # excluding the bot actor meant bot-merged PRs never refreshed the release
+        # PR (fatal on `hotfixes`, where every merge is a bot auto-merge). Reset
+        # force-pushes are harmless: the detect step below no-ops when in sync with
+        # master. workflow_dispatch bypasses the guard (event_name != 'push').
         if: |
-            github.actor != 'cldmv-bot[bot]' &&
-            github.actor != 'github-actions[bot]' &&
+            github.event_name != 'push' ||
             !startsWith(github.event.head_commit.message, 'chore: bump version')
         name: "🔍 Plan (detect changes + resolve PR)"
         runs-on: ubuntu-latest