ci: modernize workflows to CLDMV/.github v4 staging-branch flow

.github/workflows/branch-retention.yml

@@ -0,0 +1,38 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/automation/branch-retention.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran CLDMV
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/branch-retention.yml
+#
+# On PR merge: most branches deleted immediately; release/* keeps last 5,
+# hotfix/* keeps last 3. master/main/badges/gh-pages never touched.
+#
+# v4 flow: feature PRs merge into `next` and hotfix PRs into `hotfixes`
+# (not directly into master). next/hotfixes are in the branches: filter
+# below so this workflow fires on those PR closures too — otherwise
+# feat/* / fix/* / chore/* etc. would pile up on origin indefinitely.
+# (Repos that haven't adopted v4 just won't see those branches; the
+# extra entries in the filter are harmless.)
+name: 🌿 Branch Retention
+
+on:
+    pull_request:
+        types: [closed]
+        branches: [master, main, next, hotfixes]
+
+permissions:
+    contents: write
+    pull-requests: read
+
+jobs:
+    retain:
+        if: github.event.pull_request.merged == true
+        uses: CLDMV/.github/.github/workflows/reusable-branch-retention.yml@v4
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

.github/workflows/cla.yml

@@ -0,0 +1,60 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/security/cla.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran CLDMV
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/cla.yml
+#
+# Per-CLA-version signing with per-repo override support. Each commit author
+# must either:
+#   - Be in the org (silent pass via /orgs/CLDMV/members lookup)
+#   - Be in the exempt-bots list
+#   - Already have a signature record at the active (scope, version) in the
+#     central ledger repo (default: CLDMV/.cla-signatures)
+#   - Reply on this PR with the exact required text
+#
+# Default vs. override scope:
+#   - DEFAULT (this repo has NO root-level CLA.md): the bot uses the org-wide
+#     CLA at cla-versions/v<X.Y>.md in the ledger. Signing once covers every
+#     CLDMV repo that uses the default until the major.minor is bumped.
+#   - OVERRIDE (this repo HAS a root-level CLA.md): the bot enforces the
+#     consumer-repo text and reads the version from its header. Signatures
+#     live under signatures/<platform>/overrides/<owner>/<repo>/v<X.Y>/ and
+#     are scoped to this repo only.
+#
+# Required setup:
+#   - Bot App must have `Organization permissions → Members: read` for the
+#     org-member exemption.
+#   - Bot App must have `Repository contents: write` on the ledger repo.
+#   - Optional `CLDMV_CLA_BOT_APP_CLIENT_ID` / `CLDMV_CLA_BOT_APP_PRIVATE_KEY`
+#     org secrets override the general bot identity for CLA actions only.
+name: 📜 CLA
+
+on:
+    pull_request_target:
+        types: [opened, synchronize, reopened, ready_for_review]
+    issue_comment:
+        types: [created]
+
+permissions:
+    contents: read
+    pull-requests: write
+    statuses: write
+    issues: write
+
+jobs:
+    cla:
+        uses: CLDMV/.github/.github/workflows/reusable-cla.yml@v4
+        with:
+            cla_version: "1.0"
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+            CLA_BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_CLA_BOT_APP_CLIENT_ID }}
+            CLA_BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_CLA_BOT_APP_PRIVATE_KEY }}
+            TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }}
+            TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,56 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/automation/dependabot-auto-merge.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran CLDMV
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/dependabot-auto-merge.yml
+#
+# Auto-approves + queues auto-merge for Dependabot patch/minor bumps after
+# CI passes. Major bumps are left for a human.
+#
+# Default in v4: ON. To opt out, delete this file — Dependabot PRs still
+# flow into `next` (via dependabot.yml) but require a manual merge click.
+#
+# How v4 routing works:
+#   - dependabot.yml sets `target-branch: next`, so Dependabot opens PRs
+#     against `next`. This workflow auto-merges those PRs into `next` after
+#     CI; they batch into the next release like every other change.
+#   - For security advisories, hotfix-redirector.yml (release-flow-v4/)
+#     detects GHSA references in the PR body and retargets the PR from
+#     `next` → `hotfixes` *before* this workflow runs, so security updates
+#     auto-merge into the hotfix lane instead of waiting for the next batch.
+#
+# Required setup (one-time per repo):
+#   1. Settings → Pull Requests → "Allow auto-merge" → ON
+#      (enabled automatically by `release-flow-v4/v4-bootstrap.yml`)
+#   2. Branch protection on `next` and `hotfixes` with required CI status
+#      checks — the action refuses to merge into an unprotected branch.
+# Both are validated by the action; the workflow fails loudly if missing.
+name: 🤖 Dependabot Auto-Merge
+
+on:
+    pull_request:
+        types: [opened, reopened, synchronize, ready_for_review]
+
+permissions:
+    contents: write
+    pull-requests: write
+
+jobs:
+    automerge:
+        # Pre-filter at workflow level so this doesn't spin up for every PR.
+        if: github.event.pull_request.user.login == 'dependabot[bot]'
+        uses: CLDMV/.github/.github/workflows/reusable-dependabot-auto-merge.yml@v4
+        with:
+            bump_types: "patch,minor"
+            # merge_method defaults to "merge" — Dependabot PRs target next / hotfixes,
+            # whose rulesets are merge-only. Override only if your branches differ.
+            # merge_method: "merge"
+            # also_for_actors: "renovate[bot]"   # extend if you adopt Renovate
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

.github/workflows/dependency-review.yml

@@ -0,0 +1,34 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/security/dependency-review.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran CLDMV
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/dependency-review.yml
+name: 🔒 Dependency Review
+
+on:
+    pull_request:
+        types: [opened, synchronize, reopened, ready_for_review]
+        branches: [master, main]
+
+permissions:
+    contents: read
+    pull-requests: write
+
+jobs:
+    review:
+        uses: CLDMV/.github/.github/workflows/reusable-dependency-review.yml@v4
+        with:
+            fail_on_severity: "moderate"
+            # Per-repo license policy override:
+            # deny_licenses: "AGPL-3.0,LGPL-3.0"   # block copyleft for an Apache-2.0 repo
+        # Bot App credentials. When set, the dependency-review PR comment is
+        # posted by the consumer's bot App instead of github-actions[bot].
+        # Both lines are optional; remove them to fall back to GITHUB_TOKEN.
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}