chore: Adopt the LVBT repository standard

.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "lvbt",
+  "interface": {
+    "displayName": "Las Vegans for Better Transit"
+  },
+  "plugins": [
+    {
+      "name": "lvbt-contributions",
+      "source": {
+        "source": "local",
+        "path": "../../node_modules/@lvbt/cli/plugins/lvbt-contributions"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Developer Tools"
+    }
+  ]
+}

.claude/settings.json

@@ -0,0 +1,38 @@
+{
+  "extraKnownMarketplaces": {
+    "lvbt": {
+      "source": {
+        "source": "github",
+        "repo": "LasVegasForTransit/repository-tooling",
+        "ref": "v0.2.7"
+      }
+    }
+  },
+  "enabledPlugins": {
+    "lvbt-contributions@lvbt": true
+  },
+  "hooks": {
+    "PostToolUse": [
+      {
+        "matcher": "Edit|Write",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "pnpm exec prettier --write --ignore-unknown \"$CLAUDE_FILE_PATHS\" 2>/dev/null || true"
+          }
+        ]
+      }
+    ]
+  },
+  "permissions": {
+    "deny": [
+      "Read(**/.dev.vars)",
+      "Read(**/.dev.vars.*)",
+      "Read(**/.env)",
+      "Read(**/.env.*)",
+      "Read(**/*.pem)",
+      "Read(**/*.key)",
+      "Read(**/id_rsa*)"
+    ]
+  }
+}

.codex/hooks.json

@@ -0,0 +1,16 @@
+{
+  "hooks": {
+    "PreToolUse": [
+      {
+        "matcher": "Bash|mcp__github__create_issue|mcp__github__create_pull_request",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "node \"$(git rev-parse --show-toplevel)/node_modules/@lvbt/cli/plugins/lvbt-contributions/hooks/codex-pre-tool-use.mjs\"",
+            "timeout": 10
+          }
+        ]
+      }
+    ]
+  }
+}

.editorconfig

@@ -0,0 +1,12 @@
+root = true
+
+[*]
+charset = utf-8
+end_of_line = lf
+insert_final_newline = true
+indent_style = space
+indent_size = 2
+trim_trailing_whitespace = true
+
+[*.md]
+trim_trailing_whitespace = false

.githooks/commit-msg

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+# The shared hook lives in @lvbt/cli; repository-specific steps go below it.
+set -eu
+ROOT=$(git rev-parse --show-toplevel)
+sh "$ROOT/node_modules/@lvbt/cli/hooks/commit-msg.sh" "$@"

.githooks/pre-commit

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+# The shared hook lives in @lvbt/cli; repository-specific steps go below it.
+set -eu
+ROOT=$(git rev-parse --show-toplevel)
+sh "$ROOT/node_modules/@lvbt/cli/hooks/pre-commit.sh" "$@"

.githooks/pre-push

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+# The shared hook lives in @lvbt/cli; repository-specific steps go below it.
+set -eu
+ROOT=$(git rev-parse --show-toplevel)
+sh "$ROOT/node_modules/@lvbt/cli/hooks/pre-push.sh" "$@"

.githooks/prepare-commit-msg

@@ -0,0 +1,5 @@
+#!/usr/bin/env sh
+# The shared hook lives in @lvbt/cli; repository-specific steps go below it.
+set -eu
+ROOT=$(git rev-parse --show-toplevel)
+sh "$ROOT/node_modules/@lvbt/cli/hooks/prepare-commit-msg.sh" "$@"

.github/actions/setup-node-pnpm/action.yml

@@ -4,13 +4,15 @@ description: Install the repository's pinned pnpm, cache its store, and install
 runs:
   using: composite
   steps:
+    # packageManager in package.json is the one version source; pnpm/action-setup
+    # reads it when no version input is supplied.
     - name: Setup pnpm
-      uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v5.0.0
+      uses: pnpm/action-setup@0977fd99725f1db4007ccb2928dbb4e90d06cc86 # v6.0.10
 
     - name: Setup Node
-      uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+      uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
       with:
-        node-version: 24
+        node-version-file: package.json
         cache: pnpm
 
     - name: Install dependencies

.github/renovate.json

@@ -0,0 +1,44 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": ["config:recommended", ":semanticCommits"],
+  "schedule": ["before 6am on monday"],
+  "timezone": "America/Los_Angeles",
+  "labels": ["dependencies"],
+  "prHourlyLimit": 4,
+  "prConcurrentLimit": 8,
+  "rangeStrategy": "pin",
+  "lockFileMaintenance": {
+    "enabled": true,
+    "schedule": ["before 6am on monday"]
+  },
+  "customManagers": [
+    {
+      "description": "The @lvbt/* packages install from git tags of repository-tooling with a path: suffix that the npm manager does not parse, and the Claude Code marketplace pins the same tag. Track both as one dependency on the repository's tags.",
+      "customType": "regex",
+      "managerFilePatterns": ["/(^|/)package\\.json$/", "/(^|/)\\.claude/settings\\.json$/"],
+      "matchStrings": [
+        "github:LasVegasForTransit/repository-tooling#(?<currentValue>v\\d+\\.\\d+\\.\\d+)&path:/packages/[a-z-]+",
+        "\"repo\": \"LasVegasForTransit/repository-tooling\",\\s*\"ref\": \"(?<currentValue>v\\d+\\.\\d+\\.\\d+)\""
+      ],
+      "depNameTemplate": "LasVegasForTransit/repository-tooling",
+      "datasourceTemplate": "github-tags",
+      "versioningTemplate": "semver"
+    }
+  ],
+  "packageRules": [
+    {
+      "groupName": "LVBT repository standard",
+      "matchDepNames": ["LasVegasForTransit/repository-tooling"]
+    },
+    {
+      "groupName": "dev dependencies (non-major)",
+      "matchDepTypes": ["devDependencies"],
+      "matchUpdateTypes": ["minor", "patch"]
+    },
+    {
+      "matchUpdateTypes": ["patch"],
+      "automerge": true,
+      "automergeType": "branch"
+    }
+  ]
+}

.github/workflows/ci.yml

@@ -1,10 +1,12 @@
+# The organization ruleset requires one status check named "Validate" on every
+# pull request. Add steps to this job rather than renaming it.
 name: CI
 
 on:
   pull_request:
     branches: [main]
-  push:
-    branches-ignore: [main]
+  workflow_call:
+  workflow_dispatch:
 
 permissions:
   contents: read
@@ -17,13 +19,27 @@ jobs:
   validate:
     name: Validate
     runs-on: ubuntu-latest
-    timeout-minutes: 5
+    timeout-minutes: 15
     steps:
       - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+          # The secret scan reads history, not only the proposed tree.
+          fetch-depth: 0
 
       - name: Setup Node + pnpm
         uses: ./.github/actions/setup-node-pnpm
 
-      - name: Validate published community files
+      - name: Check
         run: pnpm check
+
+      - name: Dependency audit
+        run: pnpm audit --audit-level=high
+
+      - name: Secret scan
+        run: |
+          set -euo pipefail
+          docker run --rm -v "$PWD:/repo" -w /repo \
+            ghcr.io/gitleaks/gitleaks@sha256:c00b6bd0aeb3071cbcb79009cb16a60dd9e0a7c60e2be9ab65d25e6bc8abbb7f \
+            git --redact --no-banner --config /repo/.gitleaks.toml

.gitignore

@@ -1 +1,12 @@
 node_modules/
+dist/
+coverage/
+.turbo/
+.wrangler/
+.env
+.env.*
+!.env.example
+.dev.vars
+.dev.vars.*
+.DS_Store
+.claude/worktrees/

.gitleaks.toml

@@ -0,0 +1,11 @@
+# Secret scanning. Extends gitleaks' upstream ruleset; everything below is an
+# exemption for paths that carry no secrets but trip generic entropy rules.
+[extend]
+useDefault = true
+
+[allowlist]
+description = "Paths that carry no secrets but trip generic entropy rules."
+paths = [
+  '''pnpm-lock\.yaml''',
+  '''docs/superpowers/.*\.md''',
+]

.lvbt/commit-scopes.txt

@@ -0,0 +1,6 @@
+# One scope per durable boundary in this repository.
+templates
+provenance
+docs
+ci
+dx

.markdownlint-cli2.jsonc

@@ -0,0 +1,27 @@
+{
+  // Documentation is checked like code: every relative link and anchor must
+  // resolve, and prose wraps at the same 100 columns Prettier uses.
+  "customRules": ["markdownlint-rule-relative-links"],
+  "config": {
+    "default": true,
+    "MD013": { "line_length": 100, "code_blocks": false, "tables": false, "headings": false },
+    "MD033": false,
+    "relative-links": true,
+  },
+  "globs": ["**/*.md"],
+  "ignores": [
+    // Playwright output.
+    "**/test-results",
+    "**/playwright-report",
+    ".claude/worktrees",
+    "node_modules",
+    "**/node_modules",
+    "dist",
+    "**/dist",
+    ".turbo",
+    // The inherited pull request form uses one top-level heading per field.
+    ".github/pull_request_template.md",
+    "docs/superpowers",
+    "CHANGELOG.md",
+  ],
+}

.prettierignore

@@ -0,0 +1,5 @@
+pnpm-lock.yaml
+.lvbt/web-platform/
+.claude/worktrees/
+# Generated by `wrangler types`; regenerate it, never hand-edit it.
+**/worker-configuration.d.ts

AGENTS.md

@@ -1,9 +1,8 @@
 # Working in the organization community-health repository
 
-The files under `.github/` are published copies from the pinned
-`LasVegasForTransit/repository-tooling` release. Do not edit them independently.
-Update the source repository, publish a release, then update the files and
-checksums here together.
+The files under `.github/` come from the pinned `LasVegasForTransit/repository-tooling` release.
+Changes begin in the source repository. Update the files, release provenance, and checksums here
+together after publication.
 
-Run `pnpm check` before opening a pull request. Use the organization
-`github-contribution` skill for GitHub creation.
+Run `pnpm check` before opening a pull request. Use the organization `github-contribution` skill for
+GitHub creation.

README.md

@@ -1,9 +1,9 @@
 # Las Vegans for Better Transit
 
-This special repository publishes the native GitHub issue forms and pull
-request template inherited by LVBT repositories.
+LVBT repositories inherit their GitHub issue forms and pull request template from this organization
+profile.
 
 The canonical files live in
 [`LasVegasForTransit/repository-tooling`](https://github.com/LasVegasForTransit/repository-tooling).
-[`SOURCE.json`](SOURCE.json) pins the release and checksums published here.
-Individual repositories should not copy or override these templates.
+[`SOURCE.json`](SOURCE.json) records the source release and checksums. Changes begin in the tooling
+repository and reach the organization profile through a reviewed release.

SOURCE.json

@@ -1,7 +1,7 @@
 {
   "repository": "LasVegasForTransit/repository-tooling",
-  "ref": "v0.1.3",
-  "commit": "d74383bc14738153114aa0b00f5278470da3fc26",
+  "ref": "v0.2.7",
+  "commit": "6f34bbba529a8ee53badbe6a1696658a0e0411aa",
   "files": {
     ".github/ISSUE_TEMPLATE/bug.yml": "640865f0fc20f6dbc5335db7a9a3a4b0d0e471829ff5da46c0f785497624ba36",
     ".github/ISSUE_TEMPLATE/feature.yml": "b9510f2223104a4f420a3bd52d212512f5613c65ee4cf1efdc83a8fffa1149f8",

eslint.config.js

@@ -0,0 +1,3 @@
+import { config } from '@lvbt/eslint-config/base';
+
+export default config;

package.json

@@ -1,13 +1,38 @@
 {
   "name": "lvbt-community-health",
   "private": true,
-  "version": "0.1.2",
   "type": "module",
-  "packageManager": "pnpm@11.15.1",
+  "packageManager": "pnpm@11.25.0",
   "engines": {
-    "node": ">=24"
+    "node": "^24.20.0"
   },
   "scripts": {
-    "check": "node --test --test-concurrency=1"
+    "bootstrap": "lvbt bootstrap",
+    "preflight": "lvbt preflight",
+    "build": "node --check tests/community-health.test.mjs",
+    "lint": "eslint . --max-warnings 0",
+    "check-types": "tsc --noEmit",
+    "test": "node --test --test-concurrency=1",
+    "format": "prettier --write .",
+    "format:check": "prettier --check .",
+    "check": "pnpm format:check && markdownlint-cli2 && lvbt check && pnpm lint && pnpm check-types && pnpm test",
+    "check:fix": "pnpm format && markdownlint-cli2 --fix && pnpm lint -- --fix",
+    "prepare": "git config --local core.hooksPath .githooks 2>/dev/null || true"
+  },
+  "lint-staged": {
+    "*": "prettier --write --ignore-unknown"
+  },
+  "devDependencies": {
+    "@lvbt/cli": "github:LasVegasForTransit/repository-tooling#v0.2.7&path:/packages/cli",
+    "@lvbt/eslint-config": "github:LasVegasForTransit/repository-tooling#v0.2.7&path:/packages/eslint-config",
+    "@lvbt/prettier-config": "github:LasVegasForTransit/repository-tooling#v0.2.7&path:/packages/prettier-config",
+    "@lvbt/typescript-config": "github:LasVegasForTransit/repository-tooling#v0.2.7&path:/packages/typescript-config",
+    "@types/node": "catalog:",
+    "eslint": "catalog:",
+    "lint-staged": "catalog:",
+    "markdownlint-cli2": "catalog:",
+    "markdownlint-rule-relative-links": "catalog:",
+    "prettier": "catalog:",
+    "typescript": "catalog:"
   }
 }