chore: sync pre-release.yml from Template-Generic [skip ci]

.mokogitea/ISSUE_TEMPLATE/config.yml

@@ -8,7 +8,7 @@ contact_links:
     url: https://mokoconsulting.tech/
     about: Get help or ask questions through our website
   - name: 📚 MokoStandards Documentation
-    url: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki
+    url: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
     about: View our coding standards and best practices
   - name: 🔒 Report a Security Vulnerability
     url: https://git.mokoconsulting.tech/mokoconsulting-tech/.github-private/security/advisories/new

.mokogitea/ISSUE_TEMPLATE/feature_request.md

@@ -37,7 +37,7 @@ If you have ideas about how this could be implemented, share them here:
 Add any other context, mockups, or screenshots about the feature request here.
 
 ## Relevant Standards
-Does this relate to any standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)?
+Does this relate to any standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/MokoStandards)?
 - [ ] Accessibility (WCAG 2.1 AA)
 - [ ] Localization (en_US/en_GB)
 - [ ] Security best practices

.mokogitea/ISSUE_TEMPLATE/security.md

@@ -35,7 +35,7 @@ Use this template only for:
 <!-- Describe how this could be addressed -->
 
 ## Standards Reference
-Does this relate to security standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)?
+Does this relate to security standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/MokoStandards)?
 - [ ] SPDX license identifiers
 - [ ] Secret management
 - [ ] Dependency security

.mokogitea/workflows/auto-bump.yml

@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/auto-bump.yml
 # VERSION: 09.02.00
 # BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
@@ -22,7 +22,7 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 permissions:
   contents: write
@@ -34,7 +34,8 @@ jobs:
     if: >-
       !contains(github.event.head_commit.message, '[skip ci]') &&
       !contains(github.event.head_commit.message, '[skip bump]') &&
-      !startsWith(github.event.head_commit.message, 'Merge pull request')
+      !startsWith(github.event.head_commit.message, 'Merge pull request') &&
+      !startsWith(github.event.repository.name, 'Template-')
 
     steps:
       - name: Checkout
@@ -52,7 +53,7 @@ jobs:
             echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
           else
             git clone --depth 1 --branch main --quiet \
-              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/mokocli.git" \
+              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/MokoCLI.git" \
               /tmp/mokocli
             cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
             echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"

.mokogitea/workflows/auto-release.yml

@@ -3,16 +3,16 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
-# PATH: /templates/workflows/universal/auto-release.yml.template
-# VERSION: 05.00.00
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogitea/workflows/auto-release.yml
+# VERSION: 05.01.00
 # BRIEF: Universal build & release � detects platform from manifest.xml
 #
-# +========================================================================+
+# +=======================================================================+
 # |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
-# +========================================================================+
+# +=======================================================================+
 # |                                                                        |
 # |  Reads manifest.xml (joomla|dolibarr|generic) to branch logic.       |
 # |                                                                        |
@@ -21,15 +21,24 @@
 # |    dolibarr: mod*.class.php, update.txt, dev version reset             |
 # |    generic:  README-only, no update stream                             |
 # |                                                                        |
-# +========================================================================+
+# +=======================================================================+
 
 name: "Universal: Build & Release"
 
 on:
   pull_request:
-    types: [opened, closed]
+    types: [opened, synchronize, closed]
     branches:
       - main
+    paths-ignore:
+      - '.mokogitea/workflows/**'
+      - '*.md'
+      - 'wiki/**'
+      - '.editorconfig'
+      - '.gitignore'
+      - '.gitattributes'
+      - '.gitmessage'
+      - 'LICENSE' 
   workflow_dispatch:
     inputs:
       action:
@@ -43,7 +52,7 @@ on:
 
 env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
   GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
   GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
 
@@ -51,13 +60,18 @@ permissions:
   contents: write
 
 jobs:
-  # ── PR Opened → Rename branch to RC and build RC release ─────────────────────
+  # ── PR Opened → Rename branch to RC and build RC release ─────────────────────────
   promote-rc:
     name: Promote to RC
     runs-on: release
+    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     if: >-
+      !startsWith(github.event.repository.name, 'Template-') &&
+      (
         (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
+        (github.event.action == 'synchronize' && github.event.pull_request.merged != true) ||
         (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
+      )
 
     steps:
       - name: Checkout repository
@@ -65,6 +79,7 @@ jobs:
         with:
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 1
+          submodules: recursive
 
       - name: Setup mokocli tools
         env:
@@ -80,7 +95,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet
@@ -89,18 +104,46 @@ jobs:
 
       - name: Rename branch to rc
         run: |
-          php ${MOKO_CLI}/branch_rename.php \
-            --from "${{ github.event.pull_request.head.ref || 'dev' }}" --to rc \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
-            --api-base "${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}" \
-            --pr "${{ github.event.pull_request.number }}"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          AUTH="Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}"
+          FROM="${{ github.event.pull_request.head.ref || 'dev' }}"
+          PR="${{ github.event.pull_request.number }}"
+
+          # Resolve the source branch HEAD commit.
+          SRC_JSON=$(curl -sf -H "$AUTH" "${API_BASE}/branches/${FROM}") \
+            || { echo "::error::Source branch ${FROM} not found"; exit 1; }
+          SRC_SHA=$(printf '%s' "$SRC_JSON" | python3 -c "import sys, json; print(json.load(sys.stdin)['commit']['id'])" 2>/dev/null || true)
+          [ -n "$SRC_SHA" ] || { echo "::error::Could not resolve HEAD of ${FROM}"; exit 1; }
+
+          # Point rc at the source commit. If rc already exists (a protected branch that
+          # cannot be deleted), force-update its ref in place instead of delete+recreate:
+          # deleting a protected branch fails, which then makes the recreate return HTTP 409.
+          if curl -sf -o /dev/null -H "$AUTH" "${API_BASE}/branches/rc"; then
+            echo "rc exists - force-updating to ${FROM} (${SRC_SHA})"
+            curl -sf -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
+              "${API_BASE}/git/refs/heads/rc" -d "{\"sha\":\"${SRC_SHA}\",\"force\":true}" \
+              || { echo "::error::Failed to force-update rc (CI token needs force-push on the protected rc branch)"; exit 1; }
+          else
+            echo "Creating rc from ${FROM}"
+            curl -sf -X POST -H "$AUTH" -H "Content-Type: application/json" \
+              "${API_BASE}/branches" -d "{\"new_branch_name\":\"rc\",\"old_branch_name\":\"${FROM}\"}" \
+              || { echo "::error::Failed to create rc from ${FROM}"; exit 1; }
+          fi
+
+          # Repoint the PR at rc, then delete the old source branch (non-fatal).
+          if [ -n "$PR" ]; then
+            curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
+              "${API_BASE}/pulls/${PR}" -d '{"head":"rc"}' >/dev/null || true
+          fi
+          curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true
+          echo "Renamed ${FROM} -> rc"
 
       - name: Checkout rc and configure git
         run: |
           git fetch origin rc
           git checkout rc
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Publish RC release
@@ -111,7 +154,7 @@ jobs:
 
       - name: Update RC release notes from CHANGELOG.md
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
 
           # Extract [Unreleased] section from changelog
@@ -149,13 +192,17 @@ jobs:
           echo "## Promoted to Release Candidate" >> $GITHUB_STEP_SUMMARY
           echo "Branch renamed to rc, minor bump, RC release built" >> $GITHUB_STEP_SUMMARY
 
-  # ── Merged PR → Build & Release (or promote RC to stable) ────────────────────
+  # ── Merged PR → Build & Release (or promote RC to stable) ─────────────────────────
   release:
     name: Build & Release Pipeline
     runs-on: release
+    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     if: >-
+      !startsWith(github.event.repository.name, 'Template-') &&
+      (
         github.event.pull_request.merged == true ||
         (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
+      )
 
     steps:
       - name: Checkout repository
@@ -163,11 +210,12 @@ jobs:
         with:
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           fetch-depth: 0
+          submodules: recursive
 
       - name: Configure git for bot pushes
         run: |
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
 
       - name: Check for merge conflict markers
@@ -198,7 +246,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli
             composer install --no-dev --no-interaction --quiet
@@ -241,14 +289,50 @@ jobs:
           VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
           [ -z "$VERSION" ] && VERSION="00.00.00" && echo "skip=true" >> "$GITHUB_OUTPUT"
           echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          if [[ "$PLATFORM" == joomla* ]]; then
             echo "tag=stable" >> "$GITHUB_OUTPUT"
             echo "release_tag=stable" >> "$GITHUB_OUTPUT"
+          else
+            echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+            echo "release_tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+          fi
           echo "branch=main" >> "$GITHUB_OUTPUT"
           echo "Published version: ${VERSION}"
 
+      - name: "Create semver tag for non-Joomla repos"
+        id: semver
+        if: |
+          steps.version.outputs.skip != 'true' &&
+          !startsWith(steps.platform.outputs.platform, 'joomla')
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          SEMVER_TAG="v${VERSION}"
+
+          echo "Creating semver tag: ${SEMVER_TAG}"
+
+          # Create the git tag via API
+          HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \
+            -X POST -H "Authorization: token ${TOKEN}" \
+            -H "Content-Type: application/json" \
+            "${API_BASE}/tags" \
+            -d "{\"tag_name\":\"${SEMVER_TAG}\",\"target\":\"main\",\"message\":\"Release ${VERSION}\"}" 2>/dev/null || echo "000")
+
+          if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
+            echo "Created semver tag: ${SEMVER_TAG}"
+          elif [ "$HTTP_CODE" = "409" ]; then
+            echo "Semver tag ${SEMVER_TAG} already exists (skipped)"
+          else
+            echo "::warning::Failed to create semver tag ${SEMVER_TAG} (HTTP ${HTTP_CODE})"
+          fi
+
+          echo "semver_tag=${SEMVER_TAG}" >> "$GITHUB_OUTPUT"
+
       - name: Update release notes and promote changelog
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
 
           # Get the stable release info (version and ID)
@@ -298,7 +382,7 @@ jobs:
           content = open('CHANGELOG.md').read()
           old = '## [Unreleased]'
           new = f'## [Unreleased]\n\n## [{version}] --- {date}'
-          content = content.replace(old, new, 1)
+          content = content if ('## [' + version + ']') in content else content.replace(old, new, 1)
           open('CHANGELOG.md', 'w').write(content)
           " "$VERSION" "$DATE"
             git add CHANGELOG.md
@@ -317,7 +401,7 @@ jobs:
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
           RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
           GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           php ${MOKO_CLI}/release_mirror.php \
             --version "$VERSION" --tag "$RELEASE_TAG" \
             --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
@@ -342,11 +426,11 @@ jobs:
             && echo "main branch pushed to GitHub mirror" \
             || echo "WARNING: GitHub mirror push failed"
 
-      - name: "Step 11: Delete rc branch and recreate dev from main"
+      - name: "Step 11: Delete rc branch (dev reset moved to cascade-dev.yml)"
         if: steps.version.outputs.skip != 'true'
         continue-on-error: true
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
 
           # Delete rc branch (ephemeral — created by promote-rc)
@@ -354,23 +438,15 @@ jobs:
             "${API_BASE}/branches/rc" 2>/dev/null \
             && echo "Deleted rc branch" || echo "rc branch not found"
 
-          # Delete dev branch
-          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
-            "${API_BASE}/branches/dev" 2>/dev/null && echo "Deleted dev branch"
-
-          # Recreate dev from main (now includes version bump + changelog promotion)
-          curl -sf -X POST -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/json" \
-            "${API_BASE}/branches" \
-            -d '{"new_branch_name":"dev","old_branch_name":"main"}' 2>/dev/null && echo "Recreated dev from main"
-
-          echo "Pre-release branches cleaned, dev reset from main" >> $GITHUB_STEP_SUMMARY
+          # dev is reset from main by the dedicated "Cascade Main -> Dev" workflow
+          # (cascade-dev.yml), which runs after this release completes.
+          echo "rc cleaned; dev reset handled by cascade-dev.yml" >> $GITHUB_STEP_SUMMARY
 
       - name: "Step 12: Create version branch from main"
         if: steps.version.outputs.skip != 'true'
         continue-on-error: true
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
           VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
           BRANCH_NAME="version/${VERSION}"
@@ -391,7 +467,7 @@ jobs:
         if: steps.version.outputs.skip != 'true'
         continue-on-error: true
         run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
           php ${MOKO_CLI}/version_reset_dev.php \
             --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "${API_BASE}" \
             --branch dev --path . 2>&1 || true
@@ -417,5 +493,5 @@ jobs:
             echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
             echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
             echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Release | [View](${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
+            echo "| Release | [View](${MOKOGITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
           fi

.mokogitea/workflows/branch-cleanup.yml

@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/branch-cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Delete feature branches after PR merge
@@ -33,7 +33,8 @@ jobs:
         run: |
           BRANCH="${{ github.event.pull_request.head.ref }}"
           API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
-          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
+          # URL-encode the branch name's slashes (no PHP dependency on the runner)
+          ENCODED=$(printf '%s' "${BRANCH}" | sed 's|/|%2F|g')
 
           STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
             -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \

.mokogitea/workflows/cascade-dev.yml

@@ -1,10 +1,106 @@
-# DISABLED — auto-release Step 11 recreates dev from main after every release.
-# Cascade-dev is redundant and causes version conflicts when both main and dev
-# have different version numbers in templateDetails.xml / manifest.xml.
-name: "Cascade Main → Dev (DISABLED)"
-on: workflow_dispatch
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGitea.Workflow
+# INGROUP: MokoStandards.Cascade
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogitea/workflows/cascade-dev.yml
+# VERSION: 02.00.00
+# BRIEF: Cascade main -> dev via PR; auto-merge only if conflict-free, else notify
+
+name: "Cascade Main -> Dev"
+
+on:
+  push:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  pull-requests: write
+
+env:
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  # ntfy destination is configured via repo or org variables (org vars are inherited).
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOPIC: ${{ vars.CASCADE_NTFY_TOPIC || vars.NTFY_TOPIC || 'gitea-releases' }}
+
 jobs:
-  noop:
+  cascade:
+    name: Cascade main -> dev
     runs-on: ubuntu-latest
     steps:
-      - run: echo "Cascade disabled — auto-release handles dev recreation"
+      - name: Open main -> dev PR (auto-merge if clean, else notify)
+        env:
+          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -uo pipefail
+          API="${MOKOGITEA_URL}/api/v1/repos/${REPO}"
+          AUTH="Authorization: token ${TOKEN}"
+          jqnum() { python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$1',''))" 2>/dev/null; }
+
+          # 0. dev must exist
+          if ! curl -sf -H "$AUTH" "${API}/branches/dev" >/dev/null 2>&1; then
+            echo "No dev branch - nothing to cascade."; exit 0
+          fi
+
+          # 1. is main ahead of dev?
+          AHEAD=$(curl -sf -H "$AUTH" "${API}/compare/dev...main" \
+            | python3 -c "import sys,json; print(json.load(sys.stdin).get('total_commits',0))" 2>/dev/null || echo 0)
+          if [ "${AHEAD:-0}" -eq 0 ]; then
+            echo "dev already up to date with main."; exit 0
+          fi
+          echo "main is ${AHEAD} commit(s) ahead of dev."
+
+          # 2. reuse an open main->dev PR, else create one
+          PR=$(curl -sf -H "$AUTH" "${API}/pulls?state=open&base=dev" \
+            | python3 -c "import sys,json; d=json.load(sys.stdin); print(next((str(p['number']) for p in d if p.get('head',{}).get('ref')=='main'), ''))" 2>/dev/null || echo "")
+          if [ -z "$PR" ]; then
+            RESP=$(curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/pulls" \
+              -d '{"head":"main","base":"dev","title":"chore(sync): cascade main -> dev","body":"Automated cascade of main into dev. Auto-merges only if conflict-free; otherwise left open for manual resolution."}')
+            PR=$(printf '%s' "$RESP" | jqnum number)
+            if [ -z "$PR" ]; then
+              echo "::warning::Could not open cascade PR: $RESP"; exit 0
+            fi
+            echo "Opened cascade PR #${PR}"
+          else
+            echo "Reusing open cascade PR #${PR}"
+          fi
+
+          # 3. wait for MokoGitea to compute mergeability (conflict detection)
+          MERGEABLE=""
+          for _ in 1 2 3 4 5 6; do
+            MERGEABLE=$(curl -sf -H "$AUTH" "${API}/pulls/${PR}" | jqnum mergeable)
+            case "$MERGEABLE" in True|False) break ;; esac
+            sleep 3
+          done
+          echo "mergeable=${MERGEABLE}"
+
+          notify() {
+            curl -sS \
+              -H "Title: ${REPO}: dev cascade needs manual merge" \
+              -H "Tags: warning,twisted_rightwards_arrows" \
+              -H "Priority: high" \
+              -H "Click: ${MOKOGITEA_URL}/${REPO}/pulls/${PR}" \
+              -d "main -> dev cascade PR #${PR} $1 It was NOT auto-merged; resolve it manually." \
+              "${NTFY_URL}/${NTFY_TOPIC}" || true
+          }
+
+          # 4. auto-merge only if conflict-free; otherwise notify
+          if [ "$MERGEABLE" = "True" ]; then
+            CODE=$(curl -s -o /tmp/merge.json -w "%{http_code}" -H "$AUTH" -H "Content-Type: application/json" \
+              -X POST "${API}/pulls/${PR}/merge" -d '{"Do":"merge","merge_when_checks_succeed":true}')
+            if [ "$CODE" -ge 200 ] && [ "$CODE" -lt 300 ]; then
+              echo "Cascade PR #${PR} merged (or scheduled to merge when checks pass)."
+            else
+              echo "::warning::Auto-merge returned HTTP ${CODE}: $(cat /tmp/merge.json)"
+              notify "could not be auto-merged (HTTP ${CODE})."
+            fi
+          else
+            echo "::warning::Cascade PR #${PR} has conflicts (mergeable=${MERGEABLE}); sending notification."
+            notify "has conflicts and cannot be merged automatically."
+          fi

.mokogitea/workflows/ci-generic.yml

@@ -3,16 +3,22 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.CI
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.gitea/workflows/ci-generic.yml
+# PATH: /.mokogitea/workflows/ci-generic.yml
 # VERSION: 01.00.00
 # BRIEF: CI pipeline — lint, validate, and test for generic projects (PHP + Node.js)
 
 name: "Generic: Project CI"
 
 on:
+  pull_request:
+    branches:
+      - main
+      - dev
+      - dev/**
+      - rc/**
   workflow_dispatch:
 
 permissions:
@@ -26,6 +32,8 @@ jobs:
   lint:
     name: Lint & Validate
     runs-on: ubuntu-latest
+    # Skip on template repos (Template-*) — they hold placeholder scaffolding, not buildable source.
+    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
 
     steps:
       - name: Checkout
@@ -123,7 +131,11 @@ jobs:
   test:
     name: Tests
     runs-on: ubuntu-latest
-    needs: lint
+    # Independent job (no `needs: lint`): the Gitea Actions scheduler does not
+    # offer the dependent 2nd job of a needs-chain to runners, so it stalls in
+    # "waiting" and is reaped by ABANDONED_JOB_TIMEOUT. Guard template repos
+    # directly (same condition lint uses) instead of gating on lint's result.
+    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
 
     steps:
       - name: Checkout

.mokogitea/workflows/ci-issue-reporter.yml

@@ -0,0 +1,68 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGitea.Workflow
+# INGROUP: mokocli.Universal
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogitea/workflows/ci-issue-reporter.yml
+# VERSION: 01.00.00
+# BRIEF: Reusable workflow — creates/updates a MokoGitea issue when a CI gate fails.
+#        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
+
+name: "Universal: CI Issue Reporter"
+
+on:
+  workflow_call:
+    inputs:
+      gate:
+        description: "CI gate name (e.g. PR Validation, Repository Health)"
+        required: true
+        type: string
+      details:
+        description: "Human-readable failure description"
+        required: true
+        type: string
+      severity:
+        description: "error or warning"
+        required: false
+        type: string
+        default: "error"
+      workflow:
+        description: "Workflow name for the issue title"
+        required: false
+        type: string
+        default: ""
+    secrets:
+      MOKOGITEA_TOKEN:
+        required: true
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  report:
+    name: "Report: ${{ inputs.gate }}"
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Clone MokoCLI
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+        run: |
+          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          git clone --depth 1 --filter=blob:none --sparse "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
+          cd /tmp/mokocli && git sparse-checkout set cli/ci_issue_reporter.sh
+
+      - name: Report CI failure
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+        run: |
+          chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
+          /tmp/mokocli/cli/ci_issue_reporter.sh \
+            --gate "${{ inputs.gate }}" \
+            --details "${{ inputs.details }}" \
+            --severity "${{ inputs.severity }}" \
+            --workflow "${{ inputs.workflow }}"

.mokogitea/workflows/cleanup.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Maintenance
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.gitea/workflows/cleanup.yml
+# PATH: /.mokogitea/workflows/cleanup.yml
 # VERSION: 01.00.00
 # BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
 
@@ -21,7 +21,7 @@ permissions:
   contents: write
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   cleanup:
@@ -33,30 +33,30 @@ jobs:
         uses: actions/checkout@v4
         with:
           fetch-depth: 0
-          token: ${{ secrets.GA_TOKEN }}
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
 
       - name: Delete merged branches
         env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
           echo "=== Merged Branch Cleanup ==="
-          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
 
           # List branches via API
-          BRANCHES=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
+          BRANCHES=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
             "${API}/branches?limit=50" | jq -r '.[].name')
 
           DELETED=0
           for BRANCH in $BRANCHES; do
             # Skip protected branches
             case "$BRANCH" in
-              main|master|develop|release/*|hotfix/*) continue ;;
+              main|master|dev|develop|rc|beta|alpha|release|release/*|production|stable|staging|hotfix/*|version/*) continue ;;
             esac
 
             # Check if branch is merged into main
             if git merge-base --is-ancestor "origin/${BRANCH}" origin/main 2>/dev/null; then
               echo "  Deleting merged branch: ${BRANCH}"
-              curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
+              curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
                 "${API}/branches/${BRANCH}" 2>/dev/null || true
               DELETED=$((DELETED + 1))
             fi
@@ -66,20 +66,20 @@ jobs:
 
       - name: Clean old workflow runs
         env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
           echo "=== Workflow Run Cleanup ==="
-          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
           CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)
 
           # Get old completed runs
-          RUNS=$(curl -sS -H "Authorization: token ${GA_TOKEN}" \
+          RUNS=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
             "${API}/actions/runs?status=completed&limit=50" | \
             jq -r ".workflow_runs[] | select(.created_at < \"${CUTOFF}\") | .id" 2>/dev/null)
 
           DELETED=0
           for RUN_ID in $RUNS; do
-            curl -sS -X DELETE -H "Authorization: token ${GA_TOKEN}" \
+            curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
               "${API}/actions/runs/${RUN_ID}" 2>/dev/null || true
             DELETED=$((DELETED + 1))
           done

.mokogitea/workflows/gitleaks.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Security
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
-# PATH: /templates/workflows/gitleaks.yml.template
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API
+# PATH: /.mokogitea/workflows/gitleaks.yml
 # VERSION: 01.00.00
 # BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
 #

.mokogitea/workflows/issue-branch.yml

@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Automation
-# VERSION: 01.00.36
+# VERSION: 01.00.00
 # BRIEF: Auto-create feature branch when an issue is opened
 
 name: "Universal: Issue Branch"
@@ -19,7 +19,7 @@ permissions:
   issues: write
 
 env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
 
 jobs:
   create-branch:
@@ -28,8 +28,8 @@ jobs:
     steps:
       - name: Create branch and comment
         run: |
-          TOKEN="${{ secrets.GA_TOKEN }}"
-          API="${GITEA_URL}/api/v1/repos/${{ github.repository }}"
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
           ISSUE_NUM="${{ github.event.issue.number }}"
           ISSUE_TITLE="${{ github.event.issue.title }}"
 
@@ -58,7 +58,7 @@ jobs:
             echo "Created branch: ${BRANCH}"
 
             # Comment on issue with branch link
-            REPO_URL="${GITEA_URL}/${{ github.repository }}"
+            REPO_URL="${MOKOGITEA_URL}/${{ github.repository }}"
             BODY="Branch created: [\`${BRANCH}\`](${REPO_URL}/src/branch/${BRANCH})\n\n\`\`\`bash\ngit fetch origin\ngit checkout ${BRANCH}\n\`\`\`"
 
             curl -sf -X POST \

.mokogitea/workflows/notify.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: MokoStandards.Notifications
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.gitea/workflows/notify.yml
+# PATH: /.mokogitea/workflows/notify.yml
 # VERSION: 01.00.00
 # BRIEF: Push notifications via ntfy on release success or workflow failure
 
@@ -15,9 +15,9 @@ name: "Universal: Notifications"
 on:
   workflow_run:
     workflows:
-      - "Joomla Build & Release"
-      - "Joomla Extension CI"
-      - "Deploy"
+      - "Universal: Build & Release"
+      - "Joomla: Extension CI"
+      - "Generic: Project CI"
     types:
       - completed
 

.mokogitea/workflows/pr-check.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: moko-platform.CI
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
-# PATH: /templates/workflows/universal/pr-check.yml.template
+# DEFGROUP: MokoGitea.Workflow
+# INGROUP: mokocli.CI
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogitea/workflows/pr-check.yml
 # VERSION: 09.23.00
 # BRIEF: PR gate — branch policy + code validation before merge
 
@@ -47,15 +47,15 @@ jobs:
               fi
               ;;
             fix/*|bugfix/*)
-              if [ "$BASE" != "dev" ]; then
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
                 ALLOWED=false
-                REASON="Fix branches must target 'dev', not '${BASE}'"
+                REASON="Fix branches must target 'dev' or 'main', not '${BASE}'"
               fi
               ;;
             patch/*)
-              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ] && [ "$BASE" != "main" ]; then
                 ALLOWED=false
-                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
+                REASON="Patch branches must target 'dev', 'rc', or 'main', not '${BASE}'"
               fi
               ;;
             hotfix/*)
@@ -86,7 +86,8 @@ jobs:
             echo "" >> $GITHUB_STEP_SUMMARY
             echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
             echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
-            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`patch/*\` → \`dev\`, \`rc\`, or \`main\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
             echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
@@ -96,6 +97,80 @@ jobs:
           echo "Branch policy: OK (${HEAD} → ${BASE})"
           echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY
 
+  # ── Docs Update Gate (main PRs) ─────────────────────────────────────────
+  require-docs:
+    name: Require Docs Update
+    runs-on: ubuntu-latest
+    # Enforce only on PRs merging into main: README.md + CHANGELOG.md must both be updated.
+    if: ${{ github.base_ref == 'main' }}
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Require README.md and CHANGELOG.md in the PR diff
+        run: |
+          BASE="${{ github.event.pull_request.base.sha }}"
+          HEAD="${{ github.event.pull_request.head.sha }}"
+          CHANGED="$(git diff --name-only "$BASE" "$HEAD" 2>/dev/null || true)"
+          if [ -z "$CHANGED" ]; then
+            git fetch -q origin "${{ github.base_ref }}" 2>/dev/null || true
+            CHANGED="$(git diff --name-only "origin/${{ github.base_ref }}...HEAD" 2>/dev/null || true)"
+          fi
+          echo "Changed files in PR:"
+          echo "$CHANGED"
+          MISSING=""
+          echo "$CHANGED" | grep -qxE 'README\.md' || MISSING="README.md"
+          echo "$CHANGED" | grep -qxE 'CHANGELOG\.md' || MISSING="${MISSING:+$MISSING, }CHANGELOG.md"
+          if [ -n "$MISSING" ]; then
+            echo "::error::PRs into main must update: ${MISSING}"
+            {
+              echo "## Docs Update Required"
+              echo ""
+              echo "PRs merging into \`main\` must update both **README.md** and **CHANGELOG.md**."
+              echo ""
+              echo "Not updated in this PR: **${MISSING}**"
+            } >> "$GITHUB_STEP_SUMMARY"
+            exit 1
+          fi
+          echo "Docs update present (README.md + CHANGELOG.md)"
+          echo "## Docs Update: Passed" >> "$GITHUB_STEP_SUMMARY"
+
+  # ── Wiki Update Reminder (main PRs, non-blocking) ───────────────────────
+  wiki-reminder:
+    name: Wiki Update Reminder
+    runs-on: ubuntu-latest
+    if: ${{ github.base_ref == 'main' }}
+    steps:
+      - name: Remind to update the wiki
+        env:
+          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          SERVER: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          REPO: ${{ github.repository }}
+          PR: ${{ github.event.pull_request.number }}
+        run: |
+          set -uo pipefail
+          {
+            echo "## Wiki Update Reminder"
+            echo ""
+            echo "Docs are **wiki-first** at MokoConsulting. If this change affects behavior, usage, configuration, or standards, update the repo wiki:"
+            echo ""
+            echo "- ${SERVER}/${REPO}/wiki"
+            echo ""
+            echo "_Non-blocking reminder._"
+          } >> "$GITHUB_STEP_SUMMARY"
+          # Post a single PR comment (idempotent via hidden marker); best-effort, never fails.
+          API="${SERVER}/api/v1/repos/${REPO}/issues/${PR}/comments"
+          if [ -n "${TOKEN:-}" ] && [ -n "${PR:-}" ]; then
+            existing="$(curl -sf -H "Authorization: token ${TOKEN}" "$API" 2>/dev/null | grep -c 'wiki-reminder' || true)"
+            if [ "${existing:-0}" -eq 0 ]; then
+              curl -sf -H "Authorization: token ${TOKEN}" -H "Content-Type: application/json" -X POST "$API" \
+                -d '{"body":"<!-- wiki-reminder -->\n\n**Wiki reminder:** docs are wiki-first -- if this PR changes behavior, usage, config, or standards, please update the repo wiki before/after merge. _(non-blocking)_"}' >/dev/null 2>&1 || true
+            fi
+          fi
+          echo "Wiki reminder emitted (non-blocking)."
+
   # ── Secret Scanning ──────────────────────────────────────────────────
   gitleaks:
     name: Secret Scan
@@ -126,6 +201,8 @@ jobs:
   validate:
     name: Validate PR
     runs-on: ubuntu-latest
+    # Skip on template repos (Template-*) — no real manifest/source/changelog to validate.
+    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
 
     steps:
       - name: Checkout
@@ -133,7 +210,7 @@ jobs:
 
       - name: Check for merge conflict markers
         run: |
-          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
+          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --exclude-dir='.git' --exclude-dir='.mokogitea' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
           if [ -n "$CONFLICTS" ]; then
             echo "::error::Merge conflict markers found in source files"
             echo "## Conflict Markers Found" >> $GITHUB_STEP_SUMMARY
@@ -147,11 +224,12 @@ jobs:
       - name: Detect platform
         id: platform
         run: |
-          # Read platform from XML manifest (<platform> tag) or plain text fallback
-          PLATFORM=$(sed -n 's/.*<platform>\([^<]*\)<\/platform>.*/\1/p' .mokogitea/manifest.xml 2>/dev/null | head -1)
-          [ -z "$PLATFORM" ] && PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
+          # Platform comes from the MokoGitea metadata API (public GET); manifest.xml is no longer used.
+          API="${GITHUB_SERVER_URL:-https://git.mokoconsulting.tech}/api/v1/repos/${GITHUB_REPOSITORY}/metadata"
+          PLATFORM="$(curl -sf "$API" 2>/dev/null | python3 -c "import sys, json; print(json.load(sys.stdin).get('platform') or '')" 2>/dev/null || true)"
           [ -z "$PLATFORM" ] && PLATFORM="generic"
           echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+          echo "Detected platform: $PLATFORM"
 
       - name: Setup PHP
         if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
@@ -272,7 +350,7 @@ jobs:
             joomla)
               MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
               if [ -z "$MANIFEST" ]; then
-                echo "::warning::No Joomla manifest found (WaaS site)"
+                echo "::warning::No Joomla manifest found (MokoSuite site)"
                 exit 0
               fi
               echo "Manifest: ${MANIFEST}"
@@ -285,7 +363,7 @@ jobs:
               # Block legacy raw/branch update server URLs on MokoGitea
               RAW_URLS=$(grep -n 'raw/branch' "$MANIFEST" | grep -i 'mokoconsulting\|mokogitea\|git\.mokoconsulting\.tech' || true)
               if [ -n "$RAW_URLS" ]; then
-                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the Gitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
+                echo "::error::Manifest contains legacy raw/branch update server URL on MokoGitea. Use the MokoGitea Pages URL instead (e.g. /{REPO}/updates.xml not /{REPO}/raw/branch/main/updates.xml)"
                 echo "$RAW_URLS"
                 exit 1
               fi
@@ -492,43 +570,33 @@ jobs:
     name: Build RC Package
     runs-on: ubuntu-latest
     needs: [branch-policy, validate]
+    # Run only when both gates succeeded; always() forces evaluation so a skipped
+    # validate (e.g. template repos) skips this job cleanly instead of hanging.
+    if: ${{ always() && needs.branch-policy.result == 'success' && needs.validate.result == 'success' }}
 
     steps:
       - name: Trigger RC pre-release
         env:
-          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           REPO: ${{ github.repository }}
           BRANCH: ${{ github.head_ref }}
-          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
         run: |
-          curl -s -X POST             "${GITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${GITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
+          curl -s -X POST             "${MOKOGITEA_URL}/api/v1/repos/${REPO}/actions/workflows/pre-release.yml/dispatches"             -H "Authorization: token ${MOKOGITEA_TOKEN}"             -H "Content-Type: application/json"             -d "{\"ref\":\"${BRANCH}\",\"inputs\":{\"stability\":\"release-candidate\"}}"
           echo "### Pre-Release" >> $GITHUB_STEP_SUMMARY
           echo "Triggered RC build on branch \`${BRANCH}\`" >> $GITHUB_STEP_SUMMARY
 
   # ── Issue Reporter ──────────────────────────────────────────────────────
   report-issues:
     name: Report Issues
-    runs-on: ubuntu-latest
     needs: [branch-policy, validate]
     if: >-
       always() &&
       needs.validate.result == 'failure'
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
     with:
-          sparse-checkout: automation/ci-issue-reporter.sh
-          sparse-checkout-cone-mode: false
-
-      - name: "File issue for PR validation failure"
-        env:
-          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-        run: |
-          chmod +x automation/ci-issue-reporter.sh
-          ./automation/ci-issue-reporter.sh \
-            --gate "PR Validation" \
-            --workflow "PR Check" \
-            --severity error \
-            --details "PR validation failed (syntax, manifest, changelog, or source checks). See the CI run for the specific check that failed."
+      gate: "PR Validation"
+      workflow: "PR Check"
+      severity: error
+      details: "PR validation failed (syntax, manifest, changelog, or source checks). See the CI run for the specific check that failed."
+    secrets: inherit

.mokogitea/workflows/pre-release.yml

@@ -3,11 +3,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
-# PATH: /templates/workflows/universal/pre-release.yml.template
-# VERSION: 05.01.00
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogitea/workflows/pre-release.yml
+# VERSION: 05.02.01
 # BRIEF: Auto pre-release on push to dev/alpha/beta/rc branches
 
 name: "Universal: Pre-Release"
@@ -48,9 +48,13 @@ jobs:
   build:
     name: "Build Pre-Release (${{ inputs.stability || github.ref_name }})"
     runs-on: release
+    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     if: >-
+      !startsWith(github.event.repository.name, 'Template-') &&
+      (
         github.event_name == 'workflow_dispatch' ||
         github.event_name == 'push'
+      )
 
     steps:
       - name: Checkout
@@ -59,6 +63,11 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           ref: ${{ github.ref_name }}
+          submodules: recursive
+
+      - name: Update submodules to main
+        run: |
+          git submodule foreach --quiet 'git checkout main && git pull --quiet origin main' 2>/dev/null || true
 
       - name: Setup mokocli tools
         env:
@@ -75,7 +84,7 @@ jobs:
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
             rm -rf /tmp/mokocli
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/mokocli.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
             git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
             cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
             echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
@@ -88,8 +97,20 @@ jobs:
           php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
           php ${MOKO_CLI}/manifest_read.php --path . --github-output
 
+      - name: Check platform eligibility (Joomla only)
+        id: eligibility
+        run: |
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          if [[ "$PLATFORM" == joomla* ]] || [[ "$PLATFORM" == "joomla" ]]; then
+            echo "proceed=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "proceed=false" >> "$GITHUB_OUTPUT"
+            echo "::notice::Platform '$PLATFORM' — non-Joomla, skipping pre-release auto-bump"
+          fi
+
       - name: Resolve metadata and bump version
         id: meta
+        if: steps.eligibility.outputs.proceed == 'true'
         run: |
           # Auto-detect stability from branch name on push, or use input on dispatch
           if [ "${{ github.event_name }}" = "push" ]; then
@@ -135,13 +156,19 @@ jobs:
           fi
 
           # Commit version bump
-          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "gitea-actions[bot]"
+          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.name "mokogitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
           git add -A
           git diff --cached --quiet || {
             git commit -m "chore(version): pre-release bump to ${VERSION} [skip ci]"
-            git push origin HEAD 2>&1
+            # Push the bump commit, but do NOT fail the release if the target branch
+            # is protected and the release identity is not on the push allowlist.
+            # The build proceeds from the in-tree bumped version regardless; if the
+            # push is rejected, the next run simply re-bumps from the same base.
+            if ! git push origin HEAD 2>&1; then
+              echo "::warning::Version-bump commit could not be pushed (protected branch?). Building from in-tree version ${VERSION} anyway."
+            fi
           }
 
           # Auto-detect element via manifest_element.php
@@ -166,6 +193,7 @@ jobs:
 
       - name: Create release
         id: release
+        if: steps.eligibility.outputs.proceed == 'true'
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
           VERSION="${{ steps.meta.outputs.version }}"
@@ -176,6 +204,7 @@ jobs:
             --repo "${GITEA_REPO}" --branch "${{ github.ref_name }}" --prerelease
 
       - name: Update release notes from CHANGELOG.md
+        if: steps.eligibility.outputs.proceed == 'true'
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
           VERSION="${{ steps.meta.outputs.version }}"
@@ -212,6 +241,7 @@ jobs:
 
       - name: Build package and upload
         id: package
+        if: steps.eligibility.outputs.proceed == 'true'
         run: |
           VERSION="${{ steps.meta.outputs.version }}"
           TAG="${{ steps.meta.outputs.tag }}"
@@ -225,6 +255,7 @@ jobs:
       # No need to build, commit, or sync updates.xml from workflows
 
       - name: "Delete lesser pre-release channels (cascade)"
+        if: steps.eligibility.outputs.proceed == 'true'
         continue-on-error: true
         run: |
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"

.mokogitea/workflows/rc-revert.yml

@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/rc-revert.yml
 # VERSION: 09.23.00
 # BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge
@@ -25,16 +25,25 @@ jobs:
     runs-on: ubuntu-latest
     if: >-
       github.event.pull_request.merged == false &&
-      startsWith(github.event.pull_request.head.ref, 'rc/')
+      startsWith(github.event.pull_request.head.ref, 'rc/') &&
+      !startsWith(github.event.repository.name, 'Template-')
 
     steps:
       - name: Rename branch
+        env:
+          BRANCH: ${{ github.event.pull_request.head.ref }}
+          REPO: ${{ github.repository }}
+          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
-          BRANCH="${{ github.event.pull_request.head.ref }}"
+          set -euo pipefail
+          # BRANCH is attacker-controlled (PR head ref). Strict allowlist before ANY use.
+          if ! printf '%s' "$BRANCH" | grep -Eq '^rc/[A-Za-z0-9._/-]+$'; then
+            echo "::error::Refusing unsafe branch name: $BRANCH"; exit 1
+          fi
           SUFFIX="${BRANCH#rc/}"
           DEV_BRANCH="dev/${SUFFIX}"
-          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          API="${GITEA_URL}/api/v1/repos/${REPO}/branches"
 
           # Create dev/ branch from rc/ branch
           STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X POST \
@@ -42,25 +51,22 @@ jobs:
             -H "Content-Type: application/json" \
             -d "{\"new_branch_name\": \"${DEV_BRANCH}\", \"old_branch_name\": \"${BRANCH}\"}" \
             "${API}" 2>/dev/null || true)
-
           if [ "$STATUS" = "201" ]; then
-            echo "Created branch: ${DEV_BRANCH}" >> $GITHUB_STEP_SUMMARY
+            echo "Created branch: ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"
           else
-            echo "::error::Failed to create ${DEV_BRANCH} from ${BRANCH} (HTTP ${STATUS})"
-            exit 1
+            echo "::error::Failed to create ${DEV_BRANCH} from ${BRANCH} (HTTP ${STATUS})"; exit 1
           fi
 
-          # Delete rc/ branch
-          ENCODED=$(php -r "echo rawurlencode('${BRANCH}');")
+          # Read BRANCH from the environment inside PHP (getenv, no string interpolation -> no PHP injection)
+          ENCODED=$(php -r 'echo rawurlencode(getenv("BRANCH"));')
           STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
             -H "Authorization: token ${TOKEN}" \
             "${API}/${ENCODED}" 2>/dev/null || true)
-
           if [ "$STATUS" = "204" ]; then
-            echo "Deleted branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+            echo "Deleted branch: ${BRANCH}" >> "$GITHUB_STEP_SUMMARY"
           else
             echo "::warning::Failed to delete ${BRANCH} (HTTP ${STATUS})"
           fi
 
-          echo "### RC Reverted" >> $GITHUB_STEP_SUMMARY
-          echo "${BRANCH} → ${DEV_BRANCH}" >> $GITHUB_STEP_SUMMARY
+          echo "### RC Reverted" >> "$GITHUB_STEP_SUMMARY"
+          echo "${BRANCH} → ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"

.mokogitea/workflows/repo-health.yml

@@ -6,10 +6,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Validation
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/mokocli
-# PATH: /templates/workflows/joomla/repo_health.yml.template
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# PATH: /.mokogitea/workflows/repo-health.yml
 # VERSION: 09.23.00
 # BRIEF: Enforces repository guardrails by validating scripts governance, tooling availability, and core repository health artifacts.
 # ============================================================================
@@ -77,7 +77,7 @@ jobs:
       - name: Check actor permission (admin only)
         id: perm
         env:
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN || secrets.MOKOGITEA_TOKEN || github.token }}
+          TOKEN: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
           REPO: ${{ github.repository }}
           ACTOR: ${{ github.actor }}
         run: |
@@ -88,7 +88,7 @@ jobs:
 
           # Hardcoded authorized users — always allowed
           case "$ACTOR" in
-            jmiller|gitea-actions[bot])
+            jmiller|mokogitea-actions[bot])
               ALLOWED=true
               PERMISSION=admin
               METHOD="hardcoded allowlist"
@@ -671,42 +671,30 @@ jobs:
   # ═══════════════════════════════════════════════════════════════════════
   # Issue Reporter — file issues for failed gates
   # ═══════════════════════════════════════════════════════════════════════
-  report-issues:
-    name: "Report Issues"
-    runs-on: ubuntu-latest
-    needs: [access_check, scripts_governance, repo_health]
+  report-scripts:
+    name: "Report: Scripts Governance"
+    needs: [access_check, scripts_governance]
     if: >-
       always() &&
-      (needs.scripts_governance.result == 'failure' ||
-       needs.repo_health.result == 'failure')
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      needs.scripts_governance.result == 'failure'
+    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
     with:
-          sparse-checkout: automation/ci-issue-reporter.sh
-          sparse-checkout-cone-mode: false
+      gate: "Scripts Governance"
+      workflow: "Repo Health"
+      severity: error
+      details: "Scripts directory policy violations detected. Review required and allowed directories."
+    secrets: inherit
 
-      - name: "File issues for failed gates"
-        env:
-          GITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-        run: |
-          chmod +x automation/ci-issue-reporter.sh
-          REPORTER="./automation/ci-issue-reporter.sh"
-          WF="Repo Health"
-
-          report_gate() {
-            local gate="$1" result="$2" details="$3"
-            if [ "$result" = "failure" ]; then
-              "$REPORTER" --gate "$gate" --details "$details" --workflow "$WF" --severity error
-            fi
-          }
-
-          report_gate "Scripts Governance" \
-            "${{ needs.scripts_governance.result }}" \
-            "Scripts directory policy violations detected. Review required and allowed directories."
-
-          report_gate "Repository Health" \
-            "${{ needs.repo_health.result }}" \
-            "Repository health checks failed — missing required artifacts, disallowed files, or content warnings. Check the CI run summary."
+  report-health:
+    name: "Report: Repository Health"
+    needs: [access_check, repo_health]
+    if: >-
+      always() &&
+      needs.repo_health.result == 'failure'
+    uses: ./.mokogitea/workflows/ci-issue-reporter.yml
+    with:
+      gate: "Repository Health"
+      workflow: "Repo Health"
+      severity: error
+      details: "Repository health checks failed — missing required artifacts, disallowed files, or content warnings. Check the CI run summary."
+    secrets: inherit

.mokogitea/workflows/sync-on-merge.yml

@@ -0,0 +1,32 @@
+name: Sync Workflows to Repos
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '.mokogitea/workflows/**'
+
+jobs:
+  sync:
+    runs-on: ubuntu-latest
+    if: ${{ startsWith(github.event.repository.name, 'Template-') }}
+    steps:
+      - name: Checkout mokocli
+        uses: actions/checkout@v4
+        with:
+          repository: MokoConsulting/MokoCLI
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
+
+      - name: Setup PHP
+        uses: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/raw/branch/main/actions/setup-php@v1
+        with:
+          php-version: '8.1'
+
+      - name: Install dependencies
+        run: composer install --no-dev --no-interaction
+
+      - name: Sync workflows to generic repos
+        run: php automation/bulk_sync.php --platform generic --org MokoConsulting --workflows-only --auto-merge --token "${{ secrets.MOKOGITEA_TOKEN }}"
+        env:
+          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}

.mokogitea/workflows/version-set.yml

@@ -0,0 +1,131 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: MokoGitea.Workflow.Template
+# INGROUP: MokoStandards.CI
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
+# PATH: /.mokogitea/workflows/version-set.yml
+# VERSION: 01.00.00
+# BRIEF: Set or reset the extension version across all version-bearing files
+
+name: "Joomla: Set Version"
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: "Version number (e.g. 01.00.00)"
+        required: true
+        type: string
+      branch:
+        description: "Branch to update (default: current)"
+        required: false
+        type: string
+
+permissions:
+  contents: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  set-version:
+    name: Set Version to ${{ inputs.version }}
+    runs-on: ubuntu-latest
+    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
+
+    steps:
+      - name: Validate version format
+        run: |
+          VERSION="${{ inputs.version }}"
+          if ! echo "$VERSION" | grep -qP '^\d{2}\.\d{2}\.\d{2}$'; then
+            echo "::error::Invalid version format '${VERSION}' — expected XX.YY.ZZ (e.g. 01.00.00)"
+            exit 1
+          fi
+          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          token: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
+          ref: ${{ inputs.branch || github.ref }}
+          fetch-depth: 1
+
+      - name: Update manifest version
+        run: |
+          MANIFEST=""
+          for XML_FILE in $(find . -maxdepth 3 -name "*.xml" -not -path "./.git/*" -not -path "./vendor/*"); do
+            if grep -q "<extension" "$XML_FILE" 2>/dev/null; then
+              MANIFEST="$XML_FILE"
+              break
+            fi
+          done
+
+          if [ -z "$MANIFEST" ]; then
+            echo "::warning::No Joomla extension manifest found — skipping manifest update"
+          else
+            OLD_VER=$(grep -oP '<version>\K[^<]+' "$MANIFEST" | head -1)
+            sed -i "s|<version>${OLD_VER}</version>|<version>${VERSION}</version>|" "$MANIFEST"
+            echo "Manifest: ${OLD_VER} → ${VERSION} (${MANIFEST})"
+          fi
+
+      - name: Update README.md version
+        run: |
+          if [ -f "README.md" ]; then
+            if grep -qP '^\s*VERSION:\s*\d' README.md; then
+              sed -i -E "s/(VERSION:\s*)[0-9]{2}\.[0-9]{2}\.[0-9]{2}/\1${VERSION}/" README.md
+              echo "README.md version updated to ${VERSION}"
+            else
+              echo "::warning::No VERSION line found in README.md — skipping"
+            fi
+          fi
+
+      - name: Update CHANGELOG.md
+        run: |
+          if [ -f "CHANGELOG.md" ]; then
+            DATE=$(date +%Y-%m-%d)
+            # Check if this version already has an entry
+            if grep -q "^\#\# \[${VERSION}\]" CHANGELOG.md; then
+              echo "CHANGELOG.md already has entry for ${VERSION} — skipping"
+            else
+              # Insert new version entry after [Unreleased] or at the top after header
+              if grep -q '^\#\# \[Unreleased\]' CHANGELOG.md; then
+                sed -i "/^\#\# \[Unreleased\]/a\\\\n## [${VERSION}] --- ${DATE}" CHANGELOG.md
+              else
+                sed -i "/^\# Changelog/a\\\\n## [Unreleased]\n\n## [${VERSION}] --- ${DATE}" CHANGELOG.md
+              fi
+              echo "CHANGELOG.md: added entry for ${VERSION}"
+            fi
+          else
+            echo "::warning::No CHANGELOG.md found — skipping"
+          fi
+
+      - name: Update FILE INFORMATION blocks
+        run: |
+          # Update VERSION in file header blocks (# VERSION: XX.YY.ZZ)
+          find . -maxdepth 1 -type f \( -name "*.yml" -o -name "*.yaml" -o -name "*.php" -o -name "*.md" \) \
+            -not -path "./.git/*" -not -path "./vendor/*" -print0 2>/dev/null | \
+          while IFS= read -r -d '' FILE; do
+            if head -20 "$FILE" | grep -qP '^\s*#?\s*VERSION:\s*\d{2}\.\d{2}\.\d{2}'; then
+              sed -i -E "s/(#?\s*VERSION:\s*)[0-9]{2}\.[0-9]{2}\.[0-9]{2}/\1${VERSION}/" "$FILE"
+              echo "Updated FILE INFORMATION VERSION in ${FILE}"
+            fi
+          done
+
+      - name: Commit and push
+        run: |
+          git config user.name "Moko Consulting [bot]"
+          git config user.email "hello@mokoconsulting.tech"
+          git add -A
+          if git diff --cached --quiet; then
+            echo "No version changes detected — nothing to commit"
+          else
+            git commit -m "chore: set version to ${VERSION} [skip bump]
+
+Authored-by: Moko Consulting"
+            git push
+            echo "### Version Set" >> $GITHUB_STEP_SUMMARY
+            echo "Version updated to \`${VERSION}\` on branch \`${GITHUB_REF_NAME}\`" >> $GITHUB_STEP_SUMMARY
+          fi

.mokogitea/workflows/workflow-sync-trigger.yml

@@ -3,9 +3,9 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
+# DEFGROUP: MokoGitea.Workflow
 # INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
 # PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
 # VERSION: 01.01.00
 # BRIEF: Trigger workflow sync to live repos when a PR is merged to main
@@ -13,6 +13,7 @@
 name: "Universal: Workflow Sync Trigger"
 
 on:
+  workflow_dispatch:
   pull_request:
     types: [closed]
     branches:
@@ -26,8 +27,10 @@ jobs:
     name: Sync workflows to live repos
     runs-on: ubuntu-latest
     if: >-
-      github.event.pull_request.merged == true &&
-      !contains(github.event.pull_request.title, '[skip sync]')
+      startsWith(github.event.repository.name, 'Template-') &&
+      (github.event_name == 'workflow_dispatch' ||
+      (github.event.pull_request.merged == true &&
+      !contains(github.event.pull_request.title, '[skip sync]')))
 
     steps:
       - name: Determine platform from repo name
@@ -49,8 +52,14 @@ jobs:
         env:
           MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
         run: |
-          GITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 "${GITEA_URL}/MokoConsulting/mokocli.git" /tmp/mokocli
+          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
+          git clone --depth 1 "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
+
+      - name: Install PHP
+        run: |
+          if ! command -v php &> /dev/null; then
+            apt-get update -qq && apt-get install -y -qq php-cli php-json php-curl > /dev/null 2>&1
+          fi
 
       - name: Install dependencies
         run: |

CHANGELOG.md

@@ -27,7 +27,6 @@
 - **CLAUDE.md** — repo-specific with channels, key patterns
 
 ### Fixed
-- **Installer** — honest install success: the package postflight now verifies every bundled child extension (component + system plugin) actually landed in `#__extensions` before showing the license/next-steps message, and enqueues an error listing any missing ones instead. Fails open so a transient query/IO glitch never fakes a failure.
 - **WebhookChannelHelper** — conversation race condition on concurrent webhooks (FOR UPDATE transaction)
 
 ### Removed

CLAUDE.md

@@ -46,8 +46,8 @@ Website Chat · Facebook Messenger · WhatsApp Business · Instagram Direct (pla
 - **Never commit** `.claude/`, `.mcp.json`, `TODO.md`, `*.min.css`/`*.min.js`
 - **Attribution**: `Authored-by: Moko Consulting`
 - **Workflow directory**: `.mokogitea/`
-- **Wiki**: documentation lives in the MokoGitea wiki, not `docs/` files
-- **Standards**: [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)
+- **Wiki**: documentation lives in the Gitea wiki, not `docs/` files
+- **Standards**: [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/MokoCLI/wiki)
 - **Changelog**: `[Unreleased]` only — release system assigns versions
 - **No mass email**: use Mailchimp/external services for bulk sending
 

CODE_OF_CONDUCT.md

@@ -14,7 +14,7 @@
 	DEFGROUP: Template-Joomla
 	INGROUP: Template-Joomla.Documentation
 	REPO: https://github.com/mokoconsulting-tech/Template-Joomla/
-  VERSION: 01.00.36
+  VERSION: 01.00.29
   PATH: ./CODE_OF_CONDUCT.md
   BRIEF: Community expectations and enforcement guidelines
   NOTE: Adapted with attribution from the Contributor Covenant v2.1

CONTRIBUTING.md

@@ -34,7 +34,7 @@ feature/* ──PR──> dev ──draft PR──> (renamed to rc) ──merge
 7. **Merging to main** triggers the stable release pipeline:
    - Minor version bump (e.g., `02.09.xx` → `02.10.00`)
    - Stability suffix stripped (clean version)
-   - MokoGitea release created with ZIP/tar.gz packages
+   - Gitea release created with ZIP/tar.gz packages
    - `updates.xml` updated (Joomla extensions)
    - `dev` branch recreated from `main`
 

GOVERNANCE.md

@@ -19,12 +19,12 @@
  DEFGROUP: mokoconsulting-tech.Template-Joomla
  INGROUP: MokoStandards.Governance
  REPO: https://github.com/mokoconsulting-tech/Template-Joomla
- VERSION: 01.00.36
+ VERSION: 01.00.29
  PATH: /GOVERNANCE.md
  BRIEF: Project governance rules, roles, and decision process for Template-Joomla
 -->
 
-[![MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)](https://github.com/mokoconsulting-tech/MokoStandards)
+[![MokoStandards](https://img.shields.io/badge/MokoStandards-04.00.04-blue)](https://github.com/mokoconsulting-tech/MokoStandards)
 
 # Project Governance
 
@@ -32,7 +32,7 @@
 
 This document defines the governance model for the `Template-Joomla` repository within the
 `mokoconsulting-tech` organization. It is automatically maintained by
-[MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki) v04.00.04.
+[MokoStandards](https://github.com/mokoconsulting-tech/MokoStandards) v04.00.04.
 
 Full governance policy is defined in the MokoStandards source repository:
 [docs/policy/GOVERNANCE.md](https://github.com/mokoconsulting-tech/MokoStandards/blob/main/docs/policy/GOVERNANCE.md)

SECURITY.md

@@ -23,7 +23,7 @@ DEFGROUP: Template-Joomla
 INGROUP: Template-Joomla.Documentation
 REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
 PATH: /SECURITY.md
-VERSION: 01.00.36
+VERSION: 01.00.29
 BRIEF: Security vulnerability reporting and handling policy
 -->
 

automation/ci-issue-reporter.sh

@@ -6,11 +6,11 @@
 #
 # FILE INFORMATION
 # DEFGROUP: Automation.CI
-# INGROUP: mokocli.Automation
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/mokocli
+# INGROUP: moko-platform.Automation
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
 # PATH: /automation/ci-issue-reporter.sh
 # VERSION: 09.23.00
-# BRIEF: Creates or updates a MokoGitea issue when a CI gate fails.
+# BRIEF: Creates or updates a Gitea issue when a CI gate fails.
 #        Deduplicates by searching open issues with the "ci-auto" label
 #        whose title matches the gate. If a matching issue exists, a comment
 #        is appended instead of opening a duplicate.
@@ -45,8 +45,8 @@ Optional:
   --workflow  Workflow name for the issue title
   --repo      owner/repo (default: \$GITHUB_REPOSITORY)
   --run-url   URL to the CI run (auto-detected from env)
-  --token     MokoGitea API token (default: \$GITEA_TOKEN)
-  --url       MokoGitea base URL (default: \$GITEA_URL)
+  --token     Gitea API token (default: \$GITEA_TOKEN)
+  --url       Gitea base URL (default: \$GITEA_URL)
 EOF
   exit 1
 }
@@ -213,7 +213,7 @@ print(json.dumps({
   ISSUE_NUM=$(echo "$RESPONSE" | grep -oP '"number":\s*\K[0-9]+' | head -1)
 
   if [[ -n "$ISSUE_NUM" ]]; then
-    # Apply label (separate call — more reliable across MokoGitea versions)
+    # Apply label (separate call — more reliable across Gitea versions)
     LABEL_ID=$(curl -sf \
       -H "Authorization: token ${GITEA_TOKEN}" \
       "${API}/labels" 2>/dev/null \

source/packages/com_mokosuitesupport/admin/language/en-GB/com_mokosuitesupport.sys.ini

@@ -1,7 +0,0 @@
-; MokoSuite Support - system language strings
-; Copyright (C) 2026 Moko Consulting. All rights reserved.
-; License GPL-3.0-or-later
-
-COM_MOKOSUITESUPPORT="MokoSuite Support"
-COM_MOKOSUITESUPPORT_SHORT="Support"
-COM_MOKOSUITESUPPORT_XML_DESCRIPTION="MokoSuite Support component."

source/packages/com_mokosuitesupport/mokosuitesupport.xml

@@ -5,13 +5,10 @@
   <creationDate>2026-06-23</creationDate>
   <copyright>Copyright (C) 2026 Moko Consulting.</copyright>
   <license>GPL-3.0-or-later</license>
-  <version>01.00.36</version>
+  <version>01.00.29</version>
   <namespace path="src">Moko\Component\MokoSuiteSupport</namespace>
   <administration>
-    <files folder="admin"><folder>language</folder><folder>services</folder><folder>src</folder><folder>tmpl</folder></files>
-    <menu>COM_MOKOSUITESUPPORT_SHORT</menu>
-    <languages folder="admin/language">
-      <language tag="en-GB">en-GB/com_mokosuitesupport.sys.ini</language>
-    </languages>
+    <files folder="admin"><folder>services</folder><folder>src</folder><folder>tmpl</folder></files>
+    <menu>COM_MOKOSUITESUPPORT</menu>
   </administration>
 </extension>

source/packages/plg_system_mokosuitesupport/mokosuitesupport.xml

@@ -8,7 +8,7 @@
 	<license>GPL-3.0-or-later</license>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>
 	<authorUrl>https://mokoconsulting.tech</authorUrl>
-	<version>01.00.36</version>
+	<version>01.00.29</version>
 	<php_minimum>8.3</php_minimum>
 	<description>PLG_SYSTEM_MOKOSUITESUPPORT_DESC</description>
 	<namespace path="src">Moko\Plugin\System\MokoSuiteSupport</namespace>

source/packages/plg_webservices_mokosuitesupport/mokosuitesupport.xml

@@ -3,7 +3,7 @@
   <name>Web Services - MokoSuite Support</name>
   <element>mokosuitesupport</element>
   <author>Moko Consulting</author>
-  <version>01.00.36</version>
+  <version>01.00.29</version>
   <license>GPL-3.0-or-later</license>
   <namespace path="src">Moko\Plugin\WebServices\MokoSuiteSupport</namespace>
   <files><folder>src</folder><folder>services</folder></files>

source/pkg_mokosuitesupport.xml

@@ -2,7 +2,7 @@
 <extension type="package" method="upgrade">
 	<name>Package - MokoSuite Support</name>
 	<packagename>mokosuitesupport</packagename>
-	<version>01.00.36</version>
+	<version>01.00.29</version>
 	<creationDate>2026-06-21</creationDate>
 	<author>Moko Consulting</author>
 	<authorEmail>hello@mokoconsulting.tech</authorEmail>

source/script.php

@@ -1,174 +0,0 @@
-<?php
-/**
- * @package     MokoSuiteSupport
- * @subpackage  pkg_mokosuitesupport
- * @copyright   Copyright (C) 2026 Moko Consulting. All rights reserved.
- * @license     GNU General Public License version 3 or later; see LICENSE
- */
-
-defined('_JEXEC') or die;
-
-use Joomla\CMS\Factory;
-use Joomla\CMS\Installer\InstallerAdapter;
-use Joomla\CMS\Log\Log;
-
-class Pkg_MokoSuiteSupportInstallerScript
-{
-	public function postflight(string $type, InstallerAdapter $adapter): void
-	{
-		// Be honest about success. Joomla's package installer only LOGS a failed child
-		// sub-install but still runs this postflight, so don't show the license /
-		// next-steps message if a bundled extension is actually missing. Fails open
-		// (see missingChildExtensions) so a query/IO glitch never fakes a failure.
-		$missing = $this->missingChildExtensions($adapter);
-
-		if (!empty($missing))
-		{
-			Factory::getApplication()->enqueueMessage(
-				'<h4>MokoSuiteSupport did not install correctly.</h4>'
-				. '<p>The following bundled extensions are missing: '
-				. htmlspecialchars(implode(', ', $missing), ENT_QUOTES) . '</p>'
-				. '<p>Please uninstall MokoSuiteSupport and reinstall the full package.</p>',
-				'error'
-			);
-
-			return;
-		}
-
-		// Warn if no license key is configured (success / next-steps path)
-		$this->warnMissingLicenseKey();
-	}
-
-	/**
-	 * Verify every child extension declared in the package manifest actually landed
-	 * in #__extensions. Returns readable labels of any that are missing.
-	 *
-	 * Matching per Joomla's #__extensions uniqueness:
-	 *   - type    = the <file> "type" attribute
-	 *   - element = the <file> "id" attribute, EXCEPT for plugins the manifest often
-	 *               declares the full `plg_<group>_<element>` id, so strip a leading
-	 *               `plg_<group>_` to get the real element; components/modules use id as-is
-	 *   - plugins ALSO match folder = the <file> "group" attribute
-	 *
-	 * FAILS OPEN: any error (unreadable manifest, query failure) returns [] so a
-	 * transient glitch never turns a good install into a false failure.
-	 *
-	 * @param   InstallerAdapter  $adapter  The package installer adapter.
-	 *
-	 * @return  string[]
-	 */
-	private function missingChildExtensions(InstallerAdapter $adapter): array
-	{
-		try
-		{
-			$manifest = $adapter->getParent()->getManifest();
-
-			if (!$manifest || !isset($manifest->files) || !isset($manifest->files->file))
-			{
-				return [];
-			}
-
-			$db      = Factory::getDbo();
-			$missing = [];
-
-			foreach ($manifest->files->file as $file)
-			{
-				$attrs  = $file->attributes();
-				$id     = isset($attrs['id']) ? (string) $attrs['id'] : '';
-				$exType = isset($attrs['type']) ? (string) $attrs['type'] : '';
-
-				if ($id === '' || $exType === '')
-				{
-					continue;
-				}
-
-				$group   = isset($attrs['group']) ? (string) $attrs['group'] : '';
-				$element = $id;
-
-				// Plugin element in #__extensions is the id minus any leading plg_<group>_.
-				if ($exType === 'plugin' && $group !== '')
-				{
-					$prefix = 'plg_' . $group . '_';
-
-					if (strpos($element, $prefix) === 0)
-					{
-						$element = substr($element, \strlen($prefix));
-					}
-				}
-
-				$query = $db->getQuery(true)
-					->select('COUNT(*)')
-					->from($db->quoteName('#__extensions'))
-					->where($db->quoteName('element') . ' = ' . $db->quote($element))
-					->where($db->quoteName('type') . ' = ' . $db->quote($exType));
-
-				if ($exType === 'plugin' && $group !== '')
-				{
-					$query->where($db->quoteName('folder') . ' = ' . $db->quote($group));
-				}
-
-				if ((int) $db->setQuery($query)->loadResult() === 0)
-				{
-					$label     = trim((string) $file);
-					$missing[] = $label !== '' ? preg_replace('/\.zip$/i', '', $label) : $id;
-				}
-			}
-
-			return $missing;
-		}
-		catch (\Throwable $e)
-		{
-			// Fail open — never fake a failure on a glitch.
-			return [];
-		}
-	}
-
-	private function warnMissingLicenseKey(): void
-	{
-		try
-		{
-			$db  = Factory::getDbo();
-			$app = Factory::getApplication();
-
-			$query = $db->getQuery(true)
-				->select([$db->quoteName('update_site_id'), $db->quoteName('extra_query')])
-				->from($db->quoteName('#__update_sites'))
-				->where('(' . $db->quoteName('name') . ' LIKE ' . $db->quote('%MokoSuiteSupport%')
-					. ' OR ' . $db->quoteName('location') . ' LIKE ' . $db->quote('%MokoSuiteSupport%') . ')')
-				->setLimit(1);
-			$db->setQuery($query);
-			$site = $db->loadObject();
-
-			if ($site)
-			{
-				$extraQuery = (string) ($site->extra_query ?? '');
-
-				if (!empty($extraQuery) && strpos($extraQuery, 'dlid=') !== false)
-				{
-					parse_str($extraQuery, $parsed);
-
-					if (!empty($parsed['dlid']))
-					{
-						return;
-					}
-				}
-
-				$editUrl = 'index.php?option=com_installer&task=updatesite.edit&update_site_id=' . (int) $site->update_site_id;
-			}
-			else
-			{
-				$editUrl = 'index.php?option=com_installer&view=updatesites';
-			}
-
-			$app->enqueueMessage(
-				'<strong>Moko Consulting License Key Required</strong> — '
-				. 'No download key is configured. Updates will not be available until a valid license key is entered. '
-				. '<a href="' . $editUrl . '" class="btn btn-sm btn-warning ms-2">Enter License Key</a>',
-				'warning'
-			);
-		}
-		catch (\Throwable $e)
-		{
-		}
-	}
-}