release: v1.0.2 - modernize workflows to CLDMV @v4 staging-branch flow

.github/workflows/branch-retention.yml

@@ -0,0 +1,38 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/automation/branch-retention.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran CLDMV
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/branch-retention.yml
+#
+# On PR merge: most branches deleted immediately; release/* keeps last 5,
+# hotfix/* keeps last 3. master/main/badges/gh-pages never touched.
+#
+# v4 flow: feature PRs merge into `next` and hotfix PRs into `hotfixes`
+# (not directly into master). next/hotfixes are in the branches: filter
+# below so this workflow fires on those PR closures too — otherwise
+# feat/* / fix/* / chore/* etc. would pile up on origin indefinitely.
+# (Repos that haven't adopted v4 just won't see those branches; the
+# extra entries in the filter are harmless.)
+name: 🌿 Branch Retention
+
+on:
+    pull_request:
+        types: [closed]
+        branches: [master, main, next, hotfixes]
+
+permissions:
+    contents: write
+    pull-requests: read
+
+jobs:
+    retain:
+        if: github.event.pull_request.merged == true
+        uses: CLDMV/.github/.github/workflows/reusable-branch-retention.yml@v4
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

.github/workflows/cla.yml

@@ -0,0 +1,60 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/security/cla.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran CLDMV
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/cla.yml
+#
+# Per-CLA-version signing with per-repo override support. Each commit author
+# must either:
+#   - Be in the org (silent pass via /orgs/CLDMV/members lookup)
+#   - Be in the exempt-bots list
+#   - Already have a signature record at the active (scope, version) in the
+#     central ledger repo (default: CLDMV/.cla-signatures)
+#   - Reply on this PR with the exact required text
+#
+# Default vs. override scope:
+#   - DEFAULT (this repo has NO root-level CLA.md): the bot uses the org-wide
+#     CLA at cla-versions/v<X.Y>.md in the ledger. Signing once covers every
+#     CLDMV repo that uses the default until the major.minor is bumped.
+#   - OVERRIDE (this repo HAS a root-level CLA.md): the bot enforces the
+#     consumer-repo text and reads the version from its header. Signatures
+#     live under signatures/<platform>/overrides/<owner>/<repo>/v<X.Y>/ and
+#     are scoped to this repo only.
+#
+# Required setup:
+#   - Bot App must have `Organization permissions → Members: read` for the
+#     org-member exemption.
+#   - Bot App must have `Repository contents: write` on the ledger repo.
+#   - Optional `CLDMV_CLA_BOT_APP_CLIENT_ID` / `CLDMV_CLA_BOT_APP_PRIVATE_KEY`
+#     org secrets override the general bot identity for CLA actions only.
+name: 📜 CLA
+
+on:
+    pull_request_target:
+        types: [opened, synchronize, reopened, ready_for_review]
+    issue_comment:
+        types: [created]
+
+permissions:
+    contents: read
+    pull-requests: write
+    statuses: write
+    issues: write
+
+jobs:
+    cla:
+        uses: CLDMV/.github/.github/workflows/reusable-cla.yml@v4
+        with:
+            cla_version: "1.0"
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+            CLA_BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_CLA_BOT_APP_CLIENT_ID }}
+            CLA_BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_CLA_BOT_APP_PRIVATE_KEY }}
+            TAGGER_NAME: ${{ secrets.CLDMV_BOT_NAME }}
+            TAGGER_EMAIL: ${{ secrets.CLDMV_BOT_EMAIL }}

.github/workflows/codeql.yml

@@ -0,0 +1,70 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/security/codeql.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran CLDMV
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/codeql.yml
+#
+# REQUIRED REPO SETTING — CodeQL must be in "Advanced" mode for this workflow
+# to upload SARIF. If the repo has CodeQL "Default setup" enabled (the
+# GitHub-managed alternative), upload runs fail with:
+#
+#   "Code Scanning could not process the submitted SARIF file: CodeQL
+#    analyses from advanced configurations cannot be processed when the
+#    default setup is enabled"
+#
+# The org-bootstrap-repo action automatically disables default setup
+# (overwrite-with-warn) on every fanout run, so a freshly-bootstrapped
+# repo lands in the right state by default. If you want to KEEP default
+# setup (the GitHub-managed config) instead of this workflow, DELETE
+# this codeql.yml file — with the conflict gone, the bootstrap leaves
+# default setup alone on subsequent runs.
+#
+# Manual fix when running outside the bootstrap:
+#   Settings → Code security and analysis → Code scanning → CodeQL
+#   analysis → ⚙️ → Switch to advanced.
+name: 🔍 CodeQL
+
+on:
+    push:
+        branches: [master, main]
+    # Same fork-PR consideration as ci.yml: pull_request fires for forks; SARIF
+    # upload to base-repo Security tab fails with read-only token. Acceptable —
+    # push-to-master analysis after merge catches anything missed. DO NOT use
+    # pull_request_target (runs base-repo workflow with secrets against fork
+    # code; dangerous).
+    pull_request:
+        types: [opened, synchronize, reopened, ready_for_review]
+        # Include the v4 integration branches (`next`, `hotfixes`) so feature
+        # and hotfix PRs trigger CodeQL. Without these, branch protection
+        # rulesets that require the CodeQL check on `next`/`hotfixes` will
+        # sit on "waiting for results" indefinitely. Branches that don't
+        # exist in a given repo simply never trigger the workflow — harmless
+        # for repos that haven't adopted the v4 staging-branch flow.
+        branches: [master, main, next, hotfixes]
+    schedule:
+        - cron: "37 14 * * 1" # weekly Monday 14:37 UTC; GitHub updates queries over time
+
+permissions:
+    security-events: write
+    contents: read
+    actions: read
+
+concurrency:
+    group: codeql-${{ github.workflow }}-${{ github.ref }}
+    cancel-in-progress: ${{ github.ref != 'refs/heads/master' && github.ref != 'refs/heads/main' }}
+
+jobs:
+    analyze:
+        uses: CLDMV/.github/.github/workflows/reusable-codeql.yml@v4
+        with:
+            languages: "javascript-typescript"
+            # Override defaults if needed:
+            # queries: "security-extended,security-and-quality"
+            # paths_ignore: "node_modules/,dist/,coverage/,**/test/**"
+            # config_file: ".github/codeql-config.yml"
+            # build_mode: "autobuild"

.github/workflows/dependabot-auto-merge.yml

@@ -0,0 +1,56 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/automation/dependabot-auto-merge.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran CLDMV
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/dependabot-auto-merge.yml
+#
+# Auto-approves + queues auto-merge for Dependabot patch/minor bumps after
+# CI passes. Major bumps are left for a human.
+#
+# Default in v4: ON. To opt out, delete this file — Dependabot PRs still
+# flow into `next` (via dependabot.yml) but require a manual merge click.
+#
+# How v4 routing works:
+#   - dependabot.yml sets `target-branch: next`, so Dependabot opens PRs
+#     against `next`. This workflow auto-merges those PRs into `next` after
+#     CI; they batch into the next release like every other change.
+#   - For security advisories, hotfix-redirector.yml (release-flow-v4/)
+#     detects GHSA references in the PR body and retargets the PR from
+#     `next` → `hotfixes` *before* this workflow runs, so security updates
+#     auto-merge into the hotfix lane instead of waiting for the next batch.
+#
+# Required setup (one-time per repo):
+#   1. Settings → Pull Requests → "Allow auto-merge" → ON
+#      (enabled automatically by `release-flow-v4/v4-bootstrap.yml`)
+#   2. Branch protection on `next` and `hotfixes` with required CI status
+#      checks — the action refuses to merge into an unprotected branch.
+# Both are validated by the action; the workflow fails loudly if missing.
+name: 🤖 Dependabot Auto-Merge
+
+on:
+    pull_request:
+        types: [opened, reopened, synchronize, ready_for_review]
+
+permissions:
+    contents: write
+    pull-requests: write
+
+jobs:
+    automerge:
+        # Pre-filter at workflow level so this doesn't spin up for every PR.
+        if: github.event.pull_request.user.login == 'dependabot[bot]'
+        uses: CLDMV/.github/.github/workflows/reusable-dependabot-auto-merge.yml@v4
+        with:
+            bump_types: "patch,minor"
+            # merge_method defaults to "merge" — Dependabot PRs target next / hotfixes,
+            # whose rulesets are merge-only. Override only if your branches differ.
+            # merge_method: "merge"
+            # also_for_actors: "renovate[bot]"   # extend if you adopt Renovate
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

.github/workflows/dependency-review.yml

@@ -0,0 +1,34 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/security/dependency-review.yml
+# @Date: 2026-05-20 00:00:00 -07:00 (1779606000)
+# @Author: Nate Corcoran CLDMV
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/dependency-review.yml
+name: 🔒 Dependency Review
+
+on:
+    pull_request:
+        types: [opened, synchronize, reopened, ready_for_review]
+        branches: [master, main]
+
+permissions:
+    contents: read
+    pull-requests: write
+
+jobs:
+    review:
+        uses: CLDMV/.github/.github/workflows/reusable-dependency-review.yml@v4
+        with:
+            fail_on_severity: "moderate"
+            # Per-repo license policy override:
+            # deny_licenses: "AGPL-3.0,LGPL-3.0"   # block copyleft for an Apache-2.0 repo
+        # Bot App credentials. When set, the dependency-review PR comment is
+        # posted by the consumer's bot App instead of github-actions[bot].
+        # Both lines are optional; remove them to fall back to GITHUB_TOKEN.
+        secrets:
+            BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+            BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}

.github/workflows/hotfix-redirector.yml

@@ -0,0 +1,71 @@
+#
+# @Project: @cldmv/.github
+# @Filename: /examples/individual-repo-workflows/release-flow-v4/hotfix-redirector.yml
+# @Date: 2026-05-22 00:00:00 -07:00 (1779778800)
+# @Author: Nate Corcoran <CLDMV>
+# @Email: <Shinrai@users.noreply.github.com>
+# @Copyright: Copyright (c) 2013-2026 Catalyzed Motivation Inc. All rights reserved.
+#
+
+# Individual repo: .github/workflows/hotfix-redirector.yml
+#
+# v4 hotfix lane: retarget hotfix/security PRs to the `hotfixes` branch.
+#
+# Two paths trigger a redirect (CLDMV/.github docs/conventions/release-flow-v4.md §5.2, §6.5):
+#   1. Head branch matches `hotfix/*` or `security/*` (human-driven hotfix flow).
+#   2. Author is `dependabot[bot]` AND its base isn't Dependabot's routine
+#      target-branch (default "next") — GitHub always overrides
+#      dependabot.yml's target-branch for security updates, so a base landing
+#      on the default branch instead of "next" is itself the signal
+#      (Dependabot's PR body doesn't reliably embed the GHSA id, so a literal
+#      GHSA reference is only a secondary check). Routine version bumps stay
+#      on `next`.
+#
+# The redirect-hotfix-pr action owns all detection logic — it skips non-matching
+# bot PRs, non-matching heads, and PRs already on `hotfixes`, and posts a
+# one-time explanatory comment with the appropriate reason.
+name: 🔀 Hotfix PR Redirector (v4)
+
+# SECURITY NOTE: pull_request_target runs in the BASE repo's context with
+# WRITE permissions + secrets. SAFE here because it is API-only — the
+# redirect-hotfix-pr action never checks out or executes PR content.
+# DO NOT add a checkout step.
+#
+# `opened` only (NOT `edited`): if a maintainer manually re-targets the PR,
+# we must not fight them by redirecting again.
+on:
+    pull_request_target:
+        types: [opened]
+
+permissions:
+    contents: read
+    pull-requests: write
+
+concurrency:
+    group: hotfix-redirector-${{ github.event.pull_request.number }}
+    cancel-in-progress: true
+
+jobs:
+    redirect:
+        name: "🔀 Redirect to hotfixes"
+        runs-on: ubuntu-latest
+        steps:
+            - name: Create App token
+              id: app-token
+              uses: CLDMV/.github/.github/actions/github/steps/create-app-token@v4
+              with:
+                  client_id: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+                  private_key: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+              env:
+                  BOT_APP_CLIENT_ID: ${{ secrets.CLDMV_BOT_APP_CLIENT_ID }}
+                  BOT_APP_PRIVATE_KEY: ${{ secrets.CLDMV_BOT_APP_PRIVATE_KEY }}
+
+            - name: Redirect hotfix/security PR to hotfixes
+              uses: CLDMV/.github/.github/actions/github/steps/redirect-hotfix-pr@v4
+              with:
+                  pr-number: ${{ github.event.pull_request.number }}
+                  github-token: ${{ steps.app-token.outputs.token }}
+                  head-ref: ${{ github.event.pull_request.head.ref }}
+                  base-ref: ${{ github.event.pull_request.base.ref }}
+                  user-type: ${{ github.event.pull_request.user.type }}
+                  target-base: hotfixes