ci(pre-release): sync universal v05 workflow with chore/** branch trigger

.gitea/ISSUE_TEMPLATE/config.yml

@@ -8,7 +8,7 @@ contact_links:
     url: https://mokoconsulting.tech/
     about: Get help or ask questions through our website
   - name: 📚 MokoStandards Documentation
-    url: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki
+    url: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
     about: View our coding standards and best practices
   - name: 🔒 Report a Security Vulnerability
     url: https://git.mokoconsulting.tech/mokoconsulting-tech/.github-private/security/advisories/new

.gitea/ISSUE_TEMPLATE/feature_request.md

@@ -37,7 +37,7 @@ If you have ideas about how this could be implemented, share them here:
 Add any other context, mockups, or screenshots about the feature request here.
 
 ## Relevant Standards
-Does this relate to any standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)?
+Does this relate to any standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/MokoStandards)?
 - [ ] Accessibility (WCAG 2.1 AA)
 - [ ] Localization (en_US/en_GB)
 - [ ] Security best practices

.gitea/ISSUE_TEMPLATE/security.md

@@ -35,7 +35,7 @@ Use this template only for:
 <!-- Describe how this could be addressed -->
 
 ## Standards Reference
-Does this relate to security standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)?
+Does this relate to security standards in [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/MokoStandards)?
 - [ ] SPDX license identifiers
 - [ ] Secret management
 - [ ] Dependency security

.gitea/manifest.xml

@@ -0,0 +1,25 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!--
+  MokoStandards Repository Manifest
+  Auto-generated by cleanup script.
+  See: https://git.mokoconsulting.tech/MokoConsulting/moko-platform/wiki/Home
+-->
+<moko-platform xmlns="https://standards.mokoconsulting.tech/moko-platform/1.0" schema-version="1.0">
+  <identity>
+    <name>dolibarr-api-mcp</name>
+    <org>MokoConsulting</org>
+    <description>MCP server for Dolibarr ERP/CRM REST API operations</description>
+    <license spdx="GPL-3.0-or-later">GNU General Public License v3</license>
+  </identity>
+  <governance>
+    <platform>nodejs</platform>
+    <standards-version>04.07.00</standards-version>
+    <standards-source>https://git.mokoconsulting.tech/MokoConsulting/moko-platform</standards-source>
+    <last-synced>2026-05-10T19:51:11+00:00</last-synced>
+  </governance>
+  <build>
+    <language>TypeScript</language>
+    <package-type>mcp-server</package-type>
+    <entry-point>src/</entry-point>
+  </build>
+</moko-platform>

.gitea/workflows/gitleaks.yml

@@ -3,10 +3,10 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
 # INGROUP: MokoStandards.Security
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards-API
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
-# PATH: /.mokogitea/workflows/gitleaks.yml
+# PATH: /templates/workflows/gitleaks.yml.template
 # VERSION: 01.00.00
 # BRIEF: Secret scanning — detect leaked credentials, API keys, and tokens
 #
@@ -25,6 +25,10 @@
 name: "Universal: Secret Scanning"
 
 on:
+  pull_request:
+    branches:
+      - main
+      - 'dev/**'
   schedule:
     - cron: '0 5 * * 1'  # Weekly Monday 05:00 UTC
   workflow_dispatch:

.gitea/workflows/notify.yml

@@ -3,7 +3,7 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
 # INGROUP: MokoStandards.Notifications
 # REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
 # PATH: /.mokogitea/workflows/notify.yml
@@ -15,9 +15,10 @@ name: "Universal: Notifications"
 on:
   workflow_run:
     workflows:
-      - "Universal: Build & Release"
+      - "Joomla Build & Release"
-      - "Joomla: Extension CI"
+      - "Joomla Extension CI"
-      - "Generic: Project CI"
+      - "Deploy"
+      - "Cascade Main → Dev"
     types:
       - completed
 

.gitea/workflows/pr-check.yml

@@ -0,0 +1,194 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoStandards.CI
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/MokoStandards-API
+# PATH: /templates/workflows/universal/pr-check.yml.template
+# VERSION: 05.00.00
+# BRIEF: PR gate — branch policy + code validation before merge
+
+name: "Universal: PR Check"
+
+on:
+  pull_request:
+    types: [opened, synchronize, reopened, edited]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+jobs:
+  # ── Branch Policy ──────────────────────────────────────────────────────
+  branch-policy:
+    name: Branch Policy
+    runs-on: ubuntu-latest
+    steps:
+      - name: Check branch merge target
+        run: |
+          HEAD="${{ github.head_ref }}"
+          BASE="${{ github.base_ref }}"
+
+          echo "PR: ${HEAD} → ${BASE}"
+
+          ALLOWED=true
+          REASON=""
+
+          case "$HEAD" in
+            feature/*|feat/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Feature branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            fix/*|bugfix/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Fix branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            hotfix/*)
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="Hotfix branches can only target 'dev' or 'main', not '${BASE}'"
+              fi
+              ;;
+            alpha/*|beta/*)
+              if [ "$BASE" != "dev" ]; then
+                ALLOWED=false
+                REASON="Pre-release branches must target 'dev', not '${BASE}'"
+              fi
+              ;;
+            rc/*)
+              if [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="Release candidate branches must target 'main', not '${BASE}'"
+              fi
+              ;;
+            dev)
+              if [ "$BASE" != "main" ]; then
+                ALLOWED=false
+                REASON="Dev branch can only merge into 'main', not '${BASE}'"
+              fi
+              ;;
+          esac
+
+          if [ "$ALLOWED" = false ]; then
+            echo "::error::${REASON}"
+            echo "## Branch Policy Violation" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "${REASON}" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "### Allowed merge paths:" >> $GITHUB_STEP_SUMMARY
+            echo "- \`feature/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`fix/*\` → \`dev\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`hotfix/*\` → \`dev\` or \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`dev\` → \`main\`" >> $GITHUB_STEP_SUMMARY
+            echo "- \`rc/*\` → \`main\`" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+
+          echo "Branch policy: OK (${HEAD} → ${BASE})"
+          echo "## Branch Policy: Passed" >> $GITHUB_STEP_SUMMARY
+
+  # ── Code Validation ────────────────────────────────────────────────────
+  validate:
+    name: Validate PR
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Detect platform
+        id: platform
+        run: |
+          PLATFORM=$(cat .mokogitea/manifest.xml 2>/dev/null | tr -d '[:space:]')
+          [ -z "$PLATFORM" ] && PLATFORM="generic"
+          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
+
+      - name: Setup PHP
+        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
+        run: |
+          if ! command -v php &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli php-mbstring php-xml >/dev/null 2>&1
+          fi
+
+      - name: PHP syntax check
+        if: steps.platform.outputs.platform == 'joomla' || steps.platform.outputs.platform == 'dolibarr'
+        run: |
+          ERRORS=0
+          while IFS= read -r -d '' file; do
+            if ! php -l "$file" 2>&1 | grep -q "No syntax errors"; then
+              ERRORS=$((ERRORS + 1))
+            fi
+          done < <(find . -name "*.php" -not -path "./.git/*" -not -path "./vendor/*" -print0)
+          echo "PHP lint: ${ERRORS} error(s)"
+          [ "$ERRORS" -eq 0 ] || { echo "::error::PHP syntax errors found"; exit 1; }
+
+      - name: Validate platform manifest
+        run: |
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          case "$PLATFORM" in
+            joomla)
+              MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
+              if [ -z "$MANIFEST" ]; then
+                echo "::warning::No Joomla manifest found (WaaS site)"
+                exit 0
+              fi
+              echo "Manifest: ${MANIFEST}"
+              if command -v php &> /dev/null; then
+                php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('$MANIFEST'); if(!\$x){foreach(libxml_get_errors() as \$e) echo \$e->message; exit(1);}" || { echo "::error::Manifest XML is malformed"; exit 1; }
+              fi
+              for ELEMENT in name version description; do
+                grep -q "<${ELEMENT}>" "$MANIFEST" || { echo "::error::Missing <${ELEMENT}> in manifest"; exit 1; }
+              done
+              echo "Joomla manifest valid"
+              ;;
+            dolibarr)
+              MOD_FILE=$(find . -maxdepth 4 -name "mod*.class.php" ! -path "./.git/*" -exec grep -l 'extends DolibarrModules' {} \; 2>/dev/null | head -1)
+              if [ -z "$MOD_FILE" ]; then
+                echo "::error::No mod*.class.php found"
+                exit 1
+              fi
+              echo "Dolibarr module: ${MOD_FILE}"
+              ;;
+            *)
+              echo "Generic platform — no manifest validation"
+              ;;
+          esac
+
+      - name: Check update stream format
+        run: |
+          PLATFORM="${{ steps.platform.outputs.platform }}"
+          case "$PLATFORM" in
+            joomla)
+              if [ -f "updates.xml" ]; then
+                if command -v php &> /dev/null; then
+                  php -r "libxml_use_internal_errors(true); \$x = simplexml_load_file('updates.xml'); if(!\$x){foreach(libxml_get_errors() as \$e) echo \$e->message; exit(1);}" || { echo "::error::updates.xml is malformed"; exit 1; }
+                fi
+                echo "updates.xml valid"
+              fi
+              ;;
+            dolibarr)
+              [ -f "update.txt" ] && echo "update.txt present" || echo "::warning::No update.txt"
+              ;;
+          esac
+
+      - name: Verify package source
+        run: |
+          SOURCE_DIR="src"
+          [ ! -d "$SOURCE_DIR" ] && SOURCE_DIR="htdocs"
+          if [ ! -d "$SOURCE_DIR" ]; then
+            echo "::warning::No src/ or htdocs/ directory"
+            exit 0
+          fi
+          FILE_COUNT=$(find "$SOURCE_DIR" -type f | wc -l)
+          echo "Source: ${FILE_COUNT} files"
+          [ "$FILE_COUNT" -gt 0 ] || { echo "::error::Source directory is empty"; exit 1; }

.gitea/workflows/security-audit.yml

@@ -0,0 +1,82 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Gitea.Workflow
+# INGROUP: MokoStandards.Security
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
+# PATH: /.mokogitea/workflows/security-audit.yml
+# VERSION: 01.00.00
+# BRIEF: Dependency vulnerability scanning for composer and npm packages
+
+name: "Universal: Security Audit"
+
+on:
+  schedule:
+    - cron: '0 6 * * 1'  # Weekly on Monday at 06:00 UTC
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'composer.json'
+      - 'composer.lock'
+      - 'package.json'
+      - 'package-lock.json'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+env:
+  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
+  NTFY_TOPIC: ${{ vars.NTFY_TOPIC || 'gitea-security' }}
+
+jobs:
+  audit:
+    name: Dependency Audit
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Composer audit
+        if: hashFiles('composer.lock') != ''
+        run: |
+          echo "=== Composer Security Audit ==="
+          if ! command -v composer &> /dev/null; then
+            sudo apt-get update -qq
+            sudo apt-get install -y -qq php-cli composer >/dev/null 2>&1
+          fi
+          composer audit --format=plain 2>&1 | tee /tmp/composer-audit.txt
+          RESULT=$?
+          if [ $RESULT -ne 0 ]; then
+            echo "::warning::Composer vulnerabilities found"
+            echo "composer_vulnerable=true" >> "$GITHUB_ENV"
+          else
+            echo "No known vulnerabilities in composer dependencies"
+          fi
+
+      - name: NPM audit
+        if: hashFiles('package-lock.json') != ''
+        run: |
+          echo "=== NPM Security Audit ==="
+          npm audit --production 2>&1 | tee /tmp/npm-audit.txt || true
+          if npm audit --production 2>&1 | grep -q "found 0 vulnerabilities"; then
+            echo "No known vulnerabilities in npm dependencies"
+          else
+            echo "::warning::NPM vulnerabilities found"
+            echo "npm_vulnerable=true" >> "$GITHUB_ENV"
+          fi
+
+      - name: Notify on vulnerabilities
+        if: env.composer_vulnerable == 'true' || env.npm_vulnerable == 'true'
+        run: |
+          REPO="${{ github.event.repository.name }}"
+          curl -sS \
+            -H "Title: ${REPO} has vulnerable dependencies" \
+            -H "Tags: lock,warning" \
+            -H "Priority: high" \
+            -d "Security audit found vulnerabilities. Review dependency updates." \
+            "${NTFY_URL}/${NTFY_TOPIC}" || true

.mokogitea/ISSUE_TEMPLATE/mcp_api_integration.md

@@ -1,48 +0,0 @@
----
-name: API Integration Request
-about: Request integration with a new REST API or service
-title: '[API] '
-labels: 'enhancement, api-integration'
-assignees: ''
-
----
-
-## API Integration Request
-
-### Target API
-- **Service Name**: [e.g., Akeeba Backup, Joomla Web Services]
-- **API Documentation**: [URL to API docs]
-- **API Type**: [REST / GraphQL / SOAP]
-- **Authentication**: [API Key / OAuth / Bearer Token / Basic Auth]
-
-### Proposed Tools
-List the MCP tools this integration would provide:
-
-| Tool Name | HTTP Method | Endpoint | Description |
-|---|---|---|---|
-| `service_list` | GET | `/api/items` | List all items |
-| `service_get` | GET | `/api/items/{id}` | Get single item |
-| `service_create` | POST | `/api/items` | Create item |
-
-### Multi-Connection
-- [ ] Single instance only
-- [ ] Multiple instances (production, staging, dev)
-- [ ] Multi-tenant (one connection per client)
-
-### Use Case
-Describe the workflow this integration enables for AI assistants.
-
-### Priority
-- [ ] Critical — blocking current work
-- [ ] High — needed soon
-- [ ] Medium — would improve workflow
-- [ ] Low — nice to have
-
-### Existing Alternatives
-Are there other ways to accomplish this today? If so, why is an MCP integration better?
-
-### Checklist
-- [ ] API documentation is available and accessible
-- [ ] API supports the required authentication method
-- [ ] I have tested the API endpoints manually
-- [ ] The integration follows the Template-MCP architecture pattern

.mokogitea/ISSUE_TEMPLATE/mcp_connection_issue.md

@@ -1,67 +0,0 @@
----
-name: MCP Connection Issue
-about: Report a connection, authentication, or API communication issue
-title: '[CONNECTION] '
-labels: 'bug, mcp-connection'
-assignees: ''
-
----
-
-## Connection Issue
-
-### Issue Type
-- [ ] Authentication failure (401/403)
-- [ ] Connection refused / timeout
-- [ ] TLS / SSL certificate error
-- [ ] Wrong connection used (wrong environment)
-- [ ] Config file not found / parse error
-- [ ] API response error (4xx / 5xx)
-
-### MCP Server
-- **Server Name**: [e.g., mcp_mokosuite]
-- **Server Version**: [e.g., 1.0.0]
-- **Node.js Version**: [e.g., 20.x]
-
-### Connection Details
-- **Connection Name**: [e.g., production, staging, default]
-- **API Base URL**: [e.g., https://api.example.com] *(do not include API keys)*
-- **Insecure Mode**: [Yes / No]
-
-### Error Message
-```
-Paste the exact error message here
-```
-
-### Steps to Reproduce
-1. Configure connection with `npm run setup`
-2. Call tool `...` with parameters `...`
-3. See error
-
-### Expected Behavior
-What should have happened.
-
-### Debugging Attempted
-- [ ] Tested API directly with curl
-- [ ] Verified API key is valid
-- [ ] Checked config file exists and is valid JSON
-- [ ] Tested with `list_connections` tool
-- [ ] Ran server manually: `node dist/index.js 2> debug.log`
-
-### Config File
-```json
-{
-  "defaultConnection": "...",
-  "connections": {
-    "connection_name": {
-      "baseUrl": "https://...",
-      "apiKey": "REDACTED"
-    }
-  }
-}
-```
-*(Redact all API keys and tokens)*
-
-### Environment
-- **OS**: [e.g., macOS 14, Ubuntu 22.04, Windows 11]
-- **Claude Code Version**: [e.g., latest]
-- **Registration**: [.mcp.json / ~/.claude.json]

.mokogitea/ISSUE_TEMPLATE/mcp_tool_request.md

@@ -1,49 +0,0 @@
----
-name: New MCP Tool Request
-about: Request a new tool to be added to this MCP server
-title: '[TOOL] '
-labels: 'enhancement, mcp-tool'
-assignees: ''
-
----
-
-## Tool Request
-
-### Tool Name
-Proposed tool name (snake_case): `resource_action`
-
-### Description
-What should this tool do? What API endpoint(s) does it map to?
-
-### API Endpoint(s)
-- **Method**: [GET / POST / PUT / PATCH / DELETE]
-- **Endpoint**: `/api/v1/...`
-- **Auth**: [API Key / Token / None]
-
-### Parameters
-
-| Parameter | Type | Required | Description |
-|---|---|---|---|
-| `id` | number | Yes | Resource ID |
-| `search` | string | No | Search filter |
-
-### Expected Response
-```json
-{
-  "id": 1,
-  "name": "Example"
-}
-```
-
-### Use Case
-Describe when and why someone would use this tool from Claude or another AI assistant.
-
-### Connection Scope
-- [ ] Works with all connections
-- [ ] Specific to certain API versions
-- [ ] Requires additional permissions
-
-### Checklist
-- [ ] I have checked this tool does not already exist
-- [ ] I have verified the API endpoint exists and is documented
-- [ ] The proposed name follows the `resource_action` convention

.mokogitea/branch-protection.yml

@@ -1,251 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-# SPDX-License-Identifier: GPL-3.0-or-later
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: moko-platform.Automation
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
-# PATH: /.gitea/workflows/branch-protection.yml
-# BRIEF: Apply standardised branch protection rules to all governed repositories
-#
-# +========================================================================+
-# |                   BRANCH PROTECTION SETUP                              |
-# +========================================================================+
-# |                                                                        |
-# |  Applies protection rules for: main, dev, rc, beta, alpha       |
-# |                                                                        |
-# |  main  — Require PR, block rejected reviews, no force push             |
-# |  dev   — Allow push, no force push, no delete                          |
-# |  rc  — Allow push, no force push, no delete                          |
-# |  beta — Allow push, no force push, no delete                         |
-# |  alpha — Allow push, no force push, no delete                        |
-# |                                                                        |
-# |  jmiller has override authority on all branches.                       |
-# |                                                                        |
-# +========================================================================+
-
-name: Branch Protection Setup
-
-on:
-  schedule:
-    - cron: '0 2 * * 1'  # Weekly Monday 02:00 UTC
-  workflow_dispatch:
-    inputs:
-      dry_run:
-        description: 'Preview mode (no changes)'
-        required: false
-        type: boolean
-        default: false
-      repos:
-        description: 'Comma-separated repo names (empty = all governed repos)'
-        required: false
-        type: string
-        default: ''
-
-env:
-  GITEA_URL: https://git.mokoconsulting.tech
-  GITEA_ORG: MokoConsulting
-
-permissions:
-  contents: read
-
-jobs:
-  protect:
-    name: Apply Branch Protection Rules
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Determine target repos
-        id: repos
-        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
-        run: |
-          API="${GITEA_URL}/api/v1"
-
-          # Platform/standards/infra repos to exclude
-          EXCLUDE="gitea-org-config org-profile gitea-private .mokogitea-private MokoStandards moko-platform MokoTesting"
-          EXCLUDE="$EXCLUDE MokoStandards-Template-Client MokoStandards-Template-Dolibarr MokoStandards-Template-Generic MokoStandards-Template-Joomla MokoDoliProjTemplate"
-
-          if [ -n "${{ inputs.repos }}" ]; then
-            # User-specified repos
-            REPOS=$(echo "${{ inputs.repos }}" | tr ',' ' ')
-          else
-            # Fetch all org repos
-            PAGE=1
-            REPOS=""
-            while true; do
-              BATCH=$(curl -sS \
-                -H "Authorization: token ${GA_TOKEN}" \
-                "${API}/orgs/${GITEA_ORG}/repos?page=${PAGE}&limit=50" \
-                | jq -r '.[].name // empty')
-              [ -z "$BATCH" ] && break
-              REPOS="$REPOS $BATCH"
-              PAGE=$((PAGE + 1))
-            done
-
-            # Filter out excluded repos
-            FILTERED=""
-            for REPO in $REPOS; do
-              SKIP=false
-              for EX in $EXCLUDE; do
-                if [ "$REPO" = "$EX" ]; then
-                  SKIP=true
-                  break
-                fi
-              done
-              if [ "$SKIP" = "false" ]; then
-                FILTERED="$FILTERED $REPO"
-              fi
-            done
-            REPOS="$FILTERED"
-          fi
-
-          echo "repos=$REPOS" >> "$GITHUB_OUTPUT"
-          COUNT=$(echo "$REPOS" | wc -w)
-          echo "📋 Target repos (${COUNT}): $REPOS"
-
-      - name: Apply protection rules
-        env:
-          GA_TOKEN: ${{ secrets.GA_TOKEN }}
-          DRY_RUN: ${{ inputs.dry_run || 'false' }}
-        run: |
-          API="${GITEA_URL}/api/v1"
-          REPOS="${{ steps.repos.outputs.repos }}"
-
-          SUCCESS=0
-          FAILED=0
-          SKIPPED=0
-
-          # ── Rule definitions ──────────────────────────────────────
-          # Only the CI bot (jmiller token) can push directly.
-          # All human contributors must use PRs.
-          # Force push disabled on all branches.
-
-          RULE_MAIN='{
-            "rule_name": "main",
-            "enable_push": true,
-            "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller"],
-            "enable_force_push": false,
-            "enable_force_push_allowlist": false,
-            "force_push_allowlist_usernames": [],
-            "enable_merge_whitelist": false,
-            "required_approvals": 0,
-            "dismiss_stale_approvals": true,
-            "block_on_rejected_reviews": true,
-            "block_on_outdated_branch": false,
-            "priority": 1
-          }'
-
-          RULE_DEV='{
-            "rule_name": "dev",
-            "enable_push": true,
-            "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller"],
-            "enable_force_push": false,
-            "enable_force_push_allowlist": false,
-            "force_push_allowlist_usernames": [],
-            "enable_merge_whitelist": false,
-            "required_approvals": 0,
-            "block_on_rejected_reviews": false,
-            "priority": 2
-          }'
-
-          RULE_RC='{
-            "rule_name": "rc",
-            "enable_push": true,
-            "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller"],
-            "enable_force_push": false,
-            "enable_force_push_allowlist": false,
-            "force_push_allowlist_usernames": [],
-            "enable_merge_whitelist": false,
-            "required_approvals": 0,
-            "block_on_rejected_reviews": false,
-            "priority": 3
-          }'
-
-          RULE_BETA='{
-            "rule_name": "beta",
-            "enable_push": true,
-            "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller"],
-            "enable_force_push": false,
-            "enable_force_push_allowlist": false,
-            "force_push_allowlist_usernames": [],
-            "enable_merge_whitelist": false,
-            "required_approvals": 0,
-            "block_on_rejected_reviews": false,
-            "priority": 4
-          }'
-
-          RULE_ALPHA='{
-            "rule_name": "alpha",
-            "enable_push": true,
-            "enable_push_whitelist": true,
-            "push_whitelist_usernames": ["jmiller"],
-            "enable_force_push": false,
-            "enable_force_push_allowlist": false,
-            "force_push_allowlist_usernames": [],
-            "enable_merge_whitelist": false,
-            "required_approvals": 0,
-            "block_on_rejected_reviews": false,
-            "priority": 5
-          }'
-
-          RULES=("$RULE_MAIN" "$RULE_DEV" "$RULE_RC" "$RULE_BETA" "$RULE_ALPHA")
-          RULE_NAMES=("main" "dev" "rc" "beta" "alpha")
-
-          # ── Apply rules to each repo ──────────────────────────────
-          for REPO in $REPOS; do
-            echo ""
-            echo "═══ ${REPO} ═══"
-
-            for i in "${!RULES[@]}"; do
-              RULE="${RULES[$i]}"
-              NAME="${RULE_NAMES[$i]}"
-
-              if [ "$DRY_RUN" = "true" ]; then
-                echo "  [DRY RUN] Would apply rule: ${NAME}"
-                SKIPPED=$((SKIPPED + 1))
-                continue
-              fi
-
-              # Delete existing rule if present (idempotent recreate)
-              ENCODED_NAME=$(echo "$NAME" | sed 's|/|%2F|g')
-              curl -sS -o /dev/null -w "" \
-                -X DELETE \
-                -H "Authorization: token ${GA_TOKEN}" \
-                "${API}/repos/${GITEA_ORG}/${REPO}/branch_protections/${ENCODED_NAME}" 2>/dev/null || true
-
-              # Create rule
-              RESPONSE=$(curl -sS -w "\n%{http_code}" \
-                -X POST \
-                -H "Authorization: token ${GA_TOKEN}" \
-                -H "Content-Type: application/json" \
-                -d "$RULE" \
-                "${API}/repos/${GITEA_ORG}/${REPO}/branch_protections")
-
-              HTTP=$(echo "$RESPONSE" | tail -1)
-              BODY=$(echo "$RESPONSE" | sed '$d')
-
-              if [ "$HTTP" = "201" ]; then
-                echo "  ✅ ${NAME}"
-                SUCCESS=$((SUCCESS + 1))
-              else
-                echo "  ❌ ${NAME} (HTTP ${HTTP}): $(echo "$BODY" | jq -r '.message // .' 2>/dev/null | head -1)"
-                FAILED=$((FAILED + 1))
-              fi
-            done
-          done
-
-          # ── Summary ───────────────────────────────────────────────
-          echo ""
-          echo "════════════════════════════════════════"
-          echo "  ✅ Success: ${SUCCESS}"
-          echo "  ❌ Failed:  ${FAILED}"
-          echo "  ⏭️  Skipped: ${SKIPPED}"
-          echo "════════════════════════════════════════"
-
-          if [ "$FAILED" -gt 0 ]; then
-            echo "::warning::${FAILED} rule(s) failed to apply"
-          fi

.mokogitea/workflows/auto-bump.yml

@@ -1,67 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/auto-bump.yml
-# VERSION: 09.02.00
-# BRIEF: Auto patch-bump version on every push to dev (skips merge commits)
-
-name: "Universal: Auto Version Bump"
-
-on:
-  push:
-    branches:
-      - dev
-      - rc
-      - 'feature/**'
-      - 'patch/**'
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-
-permissions:
-  contents: write
-
-jobs:
-  bump:
-    name: Version Bump
-    runs-on: release
-    if: >-
-      !contains(github.event.head_commit.message, '[skip ci]') &&
-      !contains(github.event.head_commit.message, '[skip bump]') &&
-      !startsWith(github.event.head_commit.message, 'Merge pull request') &&
-      !startsWith(github.event.repository.name, 'Template-')
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-        with:
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
-          fetch-depth: 1
-
-      - name: Setup mokocli tools
-        run: |
-          if ! command -v composer &> /dev/null; then
-            sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer >/dev/null 2>&1
-          fi
-          if [ -d "/opt/mokocli/cli" ]; then
-            echo "MOKO_CLI=/opt/mokocli/cli" >> "$GITHUB_ENV"
-          else
-            git clone --depth 1 --branch main --quiet \
-              "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/MokoConsulting/MokoCLI.git" \
-              /tmp/mokocli
-            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
-            echo "MOKO_CLI=/tmp/mokocli/cli" >> "$GITHUB_ENV"
-          fi
-
-      - name: Bump version
-        run: |
-          php ${MOKO_CLI}/version_auto_bump.php \
-            --path . --branch "${GITHUB_REF_NAME}" \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
-            --repo-url "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"

.mokogitea/workflows/auto-release.yml

@@ -1,497 +1,324 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
+#
-# SPDX-License-Identifier: GPL-3.0-or-later
+# SPDX-License-Identifier: GPL-3.0-or-later
-#
+#
-# FILE INFORMATION
+# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: mokocli.Release
+# INGROUP: moko-platform.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
-# PATH: /.mokogitea/workflows/auto-release.yml
+# PATH: /templates/workflows/universal/auto-release.yml.template
-# VERSION: 05.01.00
+# VERSION: 05.00.00
-# BRIEF: Universal build & release � detects platform from manifest.xml
+# BRIEF: Universal build & release � detects platform from manifest.xml
-#
+#
-# +=======================================================================+
+# +========================================================================+
-# |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
+# |              UNIVERSAL BUILD & RELEASE PIPELINE                        |
-# +=======================================================================+
+# +========================================================================+
-# |                                                                        |
+# |                                                                        |
-# |  Reads manifest.xml (joomla|dolibarr|generic) to branch logic.       |
+# |  Reads manifest.xml (joomla|dolibarr|generic) to branch logic.       |
-# |                                                                        |
+# |                                                                        |
-# |  Platform-specific:                                                    |
+# |  Platform-specific:                                                    |
-# |    joomla:   XML manifest, type-prefixed packages                      |
+# |    joomla:   XML manifest, type-prefixed packages                      |
-# |    dolibarr: mod*.class.php, update.txt, dev version reset             |
+# |    dolibarr: mod*.class.php, update.txt, dev version reset             |
-# |    generic:  README-only, no update stream                             |
+# |    generic:  README-only, no update stream                             |
-# |                                                                        |
+# |                                                                        |
-# +=======================================================================+
+# +========================================================================+
-
+
-name: "Universal: Build & Release"
+name: "Universal: Build & Release"
-
+
-on:
+on:
-  pull_request:
+  pull_request:
-    types: [opened, synchronize, closed]
+    types: [opened, closed]
-    branches:
+    branches:
-      - main
+      - main
-    paths-ignore:
+  workflow_dispatch:
-      - '.mokogitea/workflows/**'
+    inputs:
-      - '*.md'
+      action:
-      - 'wiki/**'
+        description: 'Action to perform'
-      - '.editorconfig'
+        required: false
-      - '.gitignore'
+        type: choice
-      - '.gitattributes'
+        default: release
-      - '.gitmessage'
+        options:
-      - 'LICENSE' 
+          - release
-  workflow_dispatch:
+          - promote-rc
-    inputs:
+
-      action:
+env:
-        description: 'Action to perform'
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-        required: false
+  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-        type: choice
+  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-        default: release
+  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
-        options:
+
-          - release
+permissions:
-          - promote-rc
+  contents: write
-
+
-env:
+jobs:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+  # ── PR Opened → Rename branch to RC and build RC release ─────────────────────
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
+  promote-rc:
-  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
+    name: Promote to RC
-  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
+    runs-on: release
-
+    if: >-
-permissions:
+      (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
-  contents: write
+      (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
-
+
-jobs:
+    steps:
-  # ── PR Opened → Rename branch to RC and build RC release ─────────────────────────
+      - name: Checkout repository
-  promote-rc:
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-    name: Promote to RC
+        with:
-    runs-on: release
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
-    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
+          fetch-depth: 1
-    if: >-
+
-      !startsWith(github.event.repository.name, 'Template-') &&
+      - name: Setup moko-platform tools
-      (
+        env:
-        (github.event.action == 'opened' && github.event.pull_request.merged != true) ||
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        (github.event.action == 'synchronize' && github.event.pull_request.merged != true) ||
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
-        (github.event_name == 'workflow_dispatch' && inputs.action == 'promote-rc')
+        run: |
-      )
+          if [ -f /opt/moko-platform/cli/version_bump.php ] && [ -f /opt/moko-platform/vendor/autoload.php ]; then
-
+            echo Using pre-installed /opt/moko-platform
-    steps:
+            echo MOKO_CLI=/opt/moko-platform/cli >> $GITHUB_ENV
-      - name: Checkout repository
+          else
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+            echo Falling back to fresh clone
-        with:
+            if ! command -v composer > /dev/null 2>&1; then
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
-          fetch-depth: 1
+            fi
-          submodules: recursive
+            rm -rf /tmp/moko-platform-api
-
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/moko-platform.git
-      - name: Setup mokocli tools
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/moko-platform-api
-        env:
+            cd /tmp/moko-platform-api
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+            composer install --no-dev --no-interaction --quiet
-          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+            echo MOKO_CLI=/tmp/moko-platform-api/cli >> $GITHUB_ENV
-        run: |
+          fi
-          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+
-            echo Using pre-installed /opt/mokocli
+      - name: Rename branch to rc
-            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+        run: |
-          else
+          php ${MOKO_CLI}/branch_rename.php \
-            echo Falling back to fresh clone
+            --from "${{ github.event.pull_request.head.ref || 'dev' }}" --to rc \
-            if ! command -v composer > /dev/null 2>&1; then
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
-              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            --api-base "${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}" \
-            fi
+            --pr "${{ github.event.pull_request.number }}"
-            rm -rf /tmp/mokocli
+
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
+      - name: Checkout rc and configure git
-            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+        run: |
-            cd /tmp/mokocli
+          git fetch origin rc
-            composer install --no-dev --no-interaction --quiet
+          git checkout rc
-            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          fi
+          git config --local user.name "gitea-actions[bot]"
-
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
-      - name: Rename branch to rc
+
-        run: |
+      - name: Publish RC release
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+        run: |
-          AUTH="Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}"
+          php ${MOKO_CLI}/release_publish.php \
-          FROM="${{ github.event.pull_request.head.ref || 'dev' }}"
+            --path . --stability rc --bump minor --branch rc \
-          PR="${{ github.event.pull_request.number }}"
+            --token "${{ secrets.MOKOGITEA_TOKEN }}"
-
+
-          # Resolve the source branch HEAD commit.
+      - name: Summary
-          SRC_JSON=$(curl -sf -H "$AUTH" "${API_BASE}/branches/${FROM}") \
+        if: always()
-            || { echo "::error::Source branch ${FROM} not found"; exit 1; }
+        run: |
-          SRC_SHA=$(printf '%s' "$SRC_JSON" | python3 -c "import sys, json; print(json.load(sys.stdin)['commit']['id'])" 2>/dev/null || true)
+          echo "## Promoted to Release Candidate" >> $GITHUB_STEP_SUMMARY
-          [ -n "$SRC_SHA" ] || { echo "::error::Could not resolve HEAD of ${FROM}"; exit 1; }
+          echo "Branch renamed to rc, minor bump, RC release built" >> $GITHUB_STEP_SUMMARY
-
+
-          # Point rc at the source commit. If rc already exists (a protected branch that
+  # ── Merged PR → Build & Release (or promote RC to stable) ────────────────────
-          # cannot be deleted), force-update its ref in place instead of delete+recreate:
+  release:
-          # deleting a protected branch fails, which then makes the recreate return HTTP 409.
+    name: Build & Release Pipeline
-          if curl -sf -o /dev/null -H "$AUTH" "${API_BASE}/branches/rc"; then
+    runs-on: release
-            echo "rc exists - force-updating to ${FROM} (${SRC_SHA})"
+    if: >-
-            curl -sf -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
+      github.event.pull_request.merged == true ||
-              "${API_BASE}/git/refs/heads/rc" -d "{\"sha\":\"${SRC_SHA}\",\"force\":true}" \
+      (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
-              || { echo "::error::Failed to force-update rc (CI token needs force-push on the protected rc branch)"; exit 1; }
+
-          else
+    steps:
-            echo "Creating rc from ${FROM}"
+      - name: Checkout repository
-            curl -sf -X POST -H "$AUTH" -H "Content-Type: application/json" \
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-              "${API_BASE}/branches" -d "{\"new_branch_name\":\"rc\",\"old_branch_name\":\"${FROM}\"}" \
+        with:
-              || { echo "::error::Failed to create rc from ${FROM}"; exit 1; }
+          token: ${{ secrets.MOKOGITEA_TOKEN }}
-          fi
+          fetch-depth: 0
-
+
-          # Repoint the PR at rc, then delete the old source branch (non-fatal).
+      - name: Configure git for bot pushes
-          if [ -n "$PR" ]; then
+        run: |
-            curl -s -X PATCH -H "$AUTH" -H "Content-Type: application/json" \
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-              "${API_BASE}/pulls/${PR}" -d '{"head":"rc"}' >/dev/null || true
+          git config --local user.name "gitea-actions[bot]"
-          fi
+          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
-          curl -s -X DELETE -H "$AUTH" "${API_BASE}/branches/${FROM}" >/dev/null || true
+
-          echo "Renamed ${FROM} -> rc"
+      - name: Check for merge conflict markers
-
+        run: |
-      - name: Checkout rc and configure git
+          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
-        run: |
+          if [ -n "$CONFLICTS" ]; then
-          git fetch origin rc
+            echo "::error::Merge conflict markers found — aborting release"
-          git checkout rc
+            echo "## Release Blocked: Conflict Markers" >> $GITHUB_STEP_SUMMARY
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+            echo '```' >> $GITHUB_STEP_SUMMARY
-          git config --local user.name "mokogitea-actions[bot]"
+            echo "$CONFLICTS" >> $GITHUB_STEP_SUMMARY
-          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+            echo '```' >> $GITHUB_STEP_SUMMARY
-
+            exit 1
-      - name: Publish RC release
+          fi
-        run: |
+          echo "No conflict markers found"
-          php ${MOKO_CLI}/release_publish.php \
+
-            --path . --stability rc --bump minor --branch rc \
+      - name: Setup moko-platform tools
-            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+        env:
-
+          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-      - name: Update RC release notes from CHANGELOG.md
+          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
-        run: |
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+        run: |
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          if [ -f /opt/moko-platform/cli/version_bump.php ] && [ -f /opt/moko-platform/vendor/autoload.php ]; then
-
+            echo Using pre-installed /opt/moko-platform
-          # Extract [Unreleased] section from changelog
+            echo MOKO_CLI=/opt/moko-platform/cli >> $GITHUB_ENV
-          NOTES=""
+          else
-          if [ -f "CHANGELOG.md" ]; then
+            echo Falling back to fresh clone
-            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
+            if ! command -v composer > /dev/null 2>&1; then
-          fi
+              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
-          [ -z "$NOTES" ] && NOTES="Release candidate"
+            fi
-
+            rm -rf /tmp/moko-platform-api
-          # Find the RC release and update its body
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/moko-platform.git
-          RELEASE_ID=$(curl -sf -H "Authorization: token ${TOKEN}" \
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/moko-platform-api
-            "${API_BASE}/releases/tags/release-candidate" \
+            cd /tmp/moko-platform-api
-            | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
+            composer install --no-dev --no-interaction --quiet
-
+            echo MOKO_CLI=/tmp/moko-platform-api/cli >> $GITHUB_ENV
-          if [ -n "$RELEASE_ID" ]; then
+          fi
-            python3 -c "
+
-          import json, urllib.request
+      - name: "Publish stable release"
-          body = open('/dev/stdin').read()
+        run: |
-          payload = json.dumps({'body': body}).encode()
+          php ${MOKO_CLI}/release_publish.php \
-          req = urllib.request.Request(
+            --path . --stability stable --bump minor --branch main \
-              '${API_BASE}/releases/${RELEASE_ID}',
+            --token "${{ secrets.MOKOGITEA_TOKEN }}"
-              data=payload, method='PATCH',
+
-              headers={
+      - name: Update release notes from CHANGELOG.md
-                  'Authorization': 'token ${TOKEN}',
+        run: |
-                  'Content-Type': 'application/json'
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-              })
+
-          urllib.request.urlopen(req)
+          # Extract [Unreleased] section from changelog
-          " <<< "$NOTES"
+          if [ -f "CHANGELOG.md" ]; then
-            echo "RC release notes updated from CHANGELOG.md"
+            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
-          fi
+            [ -z "$NOTES" ] && NOTES="Stable release"
-
+          else
-      - name: Summary
+            NOTES="Stable release"
-        if: always()
+          fi
-        run: |
+
-          echo "## Promoted to Release Candidate" >> $GITHUB_STEP_SUMMARY
+          # Update release body via API
-          echo "Branch renamed to rc, minor bump, RC release built" >> $GITHUB_STEP_SUMMARY
+          RELEASE_ID=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
-
+            "${API_BASE}/releases/tags/stable" | python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" 2>/dev/null || true)
-  # ── Merged PR → Build & Release (or promote RC to stable) ─────────────────────────
+
-  release:
+          if [ -n "$RELEASE_ID" ]; then
-    name: Build & Release Pipeline
+            python3 -c "
-    runs-on: release
+          import json, urllib.request
-    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
+          body = open('/dev/stdin').read()
-    if: >-
+          payload = json.dumps({'body': body}).encode()
-      !startsWith(github.event.repository.name, 'Template-') &&
+          req = urllib.request.Request(
-      (
+              '${API_BASE}/releases/${RELEASE_ID}',
-        github.event.pull_request.merged == true ||
+              data=payload, method='PATCH',
-        (github.event_name == 'workflow_dispatch' && inputs.action != 'promote-rc')
+              headers={
-      )
+                  'Authorization': 'token ${{ secrets.MOKOGITEA_TOKEN }}',
-
+                  'Content-Type': 'application/json'
-    steps:
+              })
-      - name: Checkout repository
+          urllib.request.urlopen(req)
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+          " <<< "$NOTES"
-        with:
+            echo "Release notes updated from CHANGELOG.md"
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
+          fi
-          fetch-depth: 0
+
-          submodules: recursive
+      # -- STEP 9: Mirror to GitHub (stable only) --------------------------------
-
+      - name: "Step 9: Mirror release to GitHub"
-      - name: Configure git for bot pushes
+        if: >-
-        run: |
+          steps.version.outputs.skip != 'true' &&
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          secrets.GH_MIRROR_TOKEN != ''
-          git config --local user.name "mokogitea-actions[bot]"
+        continue-on-error: true
-          git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
+        run: |
-
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-      - name: Check for merge conflict markers
+          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
-        run: |
+          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          CONFLICTS=$(grep -rn '<<<<<<< \|>>>>>>> \|^=======$' --include='*.php' --include='*.xml' --include='*.css' --include='*.js' --include='*.json' --include='*.md' --include='*.yml' --include='*.yaml' --include='*.ini' --include='*.txt' . 2>/dev/null | grep -v '.git/' || true)
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          if [ -n "$CONFLICTS" ]; then
+          php ${MOKO_CLI}/release_mirror.php \
-            echo "::error::Merge conflict markers found — aborting release"
+            --version "$VERSION" --tag "$RELEASE_TAG" \
-            echo "## Release Blocked: Conflict Markers" >> $GITHUB_STEP_SUMMARY
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
-            echo '```' >> $GITHUB_STEP_SUMMARY
+            --gh-token "${{ secrets.GH_MIRROR_TOKEN }}" --gh-repo "$GH_REPO" \
-            echo "$CONFLICTS" >> $GITHUB_STEP_SUMMARY
+            --branch main 2>&1 || true
-            echo '```' >> $GITHUB_STEP_SUMMARY
+          echo "GitHub mirror updated" >> $GITHUB_STEP_SUMMARY
-            exit 1
+
-          fi
+      # -- STEP 10: Sync main branch to GitHub mirror ----------------------------
-          echo "No conflict markers found"
+      - name: "Step 10: Push main to GitHub mirror"
-
+        if: >-
-      - name: Setup mokocli tools
+          steps.version.outputs.skip != 'true' &&
-        env:
+          secrets.GH_MIRROR_TOKEN != ''
-          MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
+        continue-on-error: true
-          MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
+        run: |
-          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_MIRROR_TOKEN }}"}}'
+          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-        run: |
+          GH_ORG=$(echo "$GH_REPO" | cut -d/ -f1)
-          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+          GH_NAME=$(echo "$GH_REPO" | cut -d/ -f2)
-            echo Using pre-installed /opt/mokocli
+          git remote add github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git" 2>/dev/null || \
-            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+            git remote set-url github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git"
-          else
+          git fetch origin main --depth=1
-            echo Falling back to fresh clone
+          git push github origin/main:refs/heads/main --force 2>/dev/null \
-            if ! command -v composer > /dev/null 2>&1; then
+            && echo "main branch pushed to GitHub mirror" \
-              sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
+            || echo "WARNING: GitHub mirror push failed"
-            fi
+
-            rm -rf /tmp/mokocli
+      - name: "Step 11: Delete rc branch and recreate dev from main"
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
+        if: steps.version.outputs.skip != 'true'
-            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+        continue-on-error: true
-            cd /tmp/mokocli
+        run: |
-            composer install --no-dev --no-interaction --quiet
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-          fi
+
-
+          # Delete rc branch (ephemeral — created by promote-rc)
-      - name: "Detect platform"
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
-        id: platform
+            "${API_BASE}/branches/rc" 2>/dev/null \
-        run: |
+            && echo "Deleted rc branch" || echo "rc branch not found"
-          php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
+
-          php ${MOKO_CLI}/manifest_read.php --path . --github-output 2>/dev/null || true
+          # Delete dev branch
-
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
-      - name: "Determine version bump level"
+            "${API_BASE}/branches/dev" 2>/dev/null && echo "Deleted dev branch"
-        id: bump
+
-        run: |
+          # Recreate dev from main (now includes version bump + changelog promotion)
-          # Fix/patch branches: version was already bumped by pre-release, just strip suffix
+          curl -sf -X POST -H "Authorization: token ${TOKEN}" \
-          # Feature/dev branches: bump minor for the new stable release
+            -H "Content-Type: application/json" \
-          HEAD_REF="${{ github.event.pull_request.head.ref || 'dev' }}"
+            "${API_BASE}/branches" \
-          case "$HEAD_REF" in
+            -d '{"new_branch_name":"dev","old_branch_name":"main"}' 2>/dev/null && echo "Recreated dev from main"
-            fix/*|patch/*|hotfix/*|bugfix/*) BUMP="none" ;;
+
-            *)                               BUMP="minor" ;;
+          echo "Pre-release branches cleaned, dev reset from main" >> $GITHUB_STEP_SUMMARY
-          esac
+
-          echo "level=${BUMP}" >> "$GITHUB_OUTPUT"
+      - name: "Step 12: Create version branch from main"
-          echo "Bump level: ${BUMP} (from branch: ${HEAD_REF})"
+        if: steps.version.outputs.skip != 'true'
-
+        continue-on-error: true
-      - name: "Publish stable release"
+        run: |
-        run: |
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          BUMP_FLAG=""
+          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-          if [ "${{ steps.bump.outputs.level }}" != "none" ]; then
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-            BUMP_FLAG="--bump ${{ steps.bump.outputs.level }}"
+          BRANCH_NAME="version/${VERSION}"
-          fi
+          MAIN_SHA=$(git rev-parse HEAD)
-          php ${MOKO_CLI}/release_publish.php \
+
-            --path . --stability stable ${BUMP_FLAG} --branch main \
+          # Delete old version branch if it exists (same version re-release)
-            --token "${{ secrets.MOKOGITEA_TOKEN }}"
+          curl -sf -X DELETE -H "Authorization: token ${TOKEN}"             "${API_BASE}/branches/${BRANCH_NAME}" 2>/dev/null && echo "Deleted old ${BRANCH_NAME}"
-
+
-      - name: "Read published version"
+          # Create version/XX.YY.ZZ from main
-        id: version
+          curl -sf -X POST -H "Authorization: token ${TOKEN}"             -H "Content-Type: application/json"             "${API_BASE}/branches"             -d "{\"new_branch_name\":\"${BRANCH_NAME}\",\"old_branch_name\":\"main\"}" 2>/dev/null             && echo "Created ${BRANCH_NAME} from main (${MAIN_SHA})"             || echo "WARNING: ${BRANCH_NAME} creation failed"
-        run: |
+
-          VERSION=$(php ${MOKO_CLI}/version_read.php --path . 2>/dev/null || echo "")
+          echo "Version branch created: ${BRANCH_NAME} (${MAIN_SHA})" >> $GITHUB_STEP_SUMMARY
-          VERSION=$(echo "$VERSION" | sed 's/-\(dev\|alpha\|beta\|rc\)$//')
+
-          [ -z "$VERSION" ] && VERSION="00.00.00" && echo "skip=true" >> "$GITHUB_OUTPUT"
+
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
+
-          PLATFORM="${{ steps.platform.outputs.platform }}"
+      # -- Dolibarr post-release: Reset dev version -----------------------------
-          if [[ "$PLATFORM" == joomla* ]]; then
+      - name: "Post-release: Reset dev version"
-            echo "tag=stable" >> "$GITHUB_OUTPUT"
+        if: steps.version.outputs.skip != 'true'
-            echo "release_tag=stable" >> "$GITHUB_OUTPUT"
+        continue-on-error: true
-          else
+        run: |
-            echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-            echo "release_tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+          php ${MOKO_CLI}/version_reset_dev.php \
-          fi
+            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "${API_BASE}" \
-          echo "branch=main" >> "$GITHUB_OUTPUT"
+            --branch dev --path . 2>&1 || true
-          echo "Published version: ${VERSION}"
+
-
+      # -- Summary --------------------------------------------------------------
-      - name: "Create semver tag for non-Joomla repos"
+      - name: Pipeline Summary
-        id: semver
+        if: always()
-        if: |
+        run: |
-          steps.version.outputs.skip != 'true' &&
+          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          !startsWith(steps.platform.outputs.platform, 'joomla')
+          PLATFORM="${{ steps.platform.outputs.platform }}"
-        run: |
+          if [ "${{ steps.version.outputs.skip }}" = "true" ]; then
-          VERSION="${{ steps.version.outputs.version }}"
+            echo "## Release Skipped" >> $GITHUB_STEP_SUMMARY
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
+            echo "No VERSION in README.md" >> $GITHUB_STEP_SUMMARY
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
+          elif [ "${{ steps.check.outputs.already_released }}" = "true" ]; then
-          SEMVER_TAG="v${VERSION}"
+            echo "## Already Released — ${VERSION}" >> $GITHUB_STEP_SUMMARY
-
+          else
-          echo "Creating semver tag: ${SEMVER_TAG}"
+            echo "" >> $GITHUB_STEP_SUMMARY
-
+            echo "## Build & Release Complete (${PLATFORM})" >> $GITHUB_STEP_SUMMARY
-          # Create the git tag via API
+            echo "" >> $GITHUB_STEP_SUMMARY
-          HTTP_CODE=$(curl -sf -o /dev/null -w "%{http_code}" \
+            echo "| Step | Result |" >> $GITHUB_STEP_SUMMARY
-            -X POST -H "Authorization: token ${TOKEN}" \
+            echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
-            -H "Content-Type: application/json" \
+            echo "| Platform | \`${PLATFORM}\` |" >> $GITHUB_STEP_SUMMARY
-            "${API_BASE}/tags" \
+            echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
-            -d "{\"tag_name\":\"${SEMVER_TAG}\",\"target\":\"main\",\"message\":\"Release ${VERSION}\"}" 2>/dev/null || echo "000")
+            echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
-
+            echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
-          if [ "$HTTP_CODE" = "201" ] || [ "$HTTP_CODE" = "200" ]; then
+            echo "| Release | [View](${GITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
-            echo "Created semver tag: ${SEMVER_TAG}"
+          fi
-          elif [ "$HTTP_CODE" = "409" ]; then
-            echo "Semver tag ${SEMVER_TAG} already exists (skipped)"
-          else
-            echo "::warning::Failed to create semver tag ${SEMVER_TAG} (HTTP ${HTTP_CODE})"
-          fi
-
-          echo "semver_tag=${SEMVER_TAG}" >> "$GITHUB_OUTPUT"
-
-      - name: Update release notes and promote changelog
-        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-
-          # Get the stable release info (version and ID)
-          RELEASE_JSON=$(curl -sf -H "Authorization: token ${TOKEN}" \
-            "${API_BASE}/releases/tags/stable" 2>/dev/null || echo '{}')
-          RELEASE_ID=$(python3 -c "import json,sys; print(json.load(sys.stdin).get('id',''))" <<< "$RELEASE_JSON" 2>/dev/null || true)
-          # Extract version from release name (e.g. "06.17.00" or "v06.17.00")
-          VERSION=$(python3 -c "
-          import json, sys, re
-          r = json.load(sys.stdin)
-          name = r.get('name', '')
-          m = re.search(r'(\d+\.\d+\.\d+)', name)
-          print(m.group(1) if m else '')
-          " <<< "$RELEASE_JSON" 2>/dev/null || true)
-
-          # Extract [Unreleased] section from changelog
-          NOTES=""
-          if [ -f "CHANGELOG.md" ]; then
-            NOTES=$(awk '/^## \[Unreleased\]/{found=1; next} /^## \[/{if(found) exit} found{print}' CHANGELOG.md)
-          fi
-          [ -z "$NOTES" ] && NOTES="Stable release"
-
-          # Update release body via API
-          if [ -n "$RELEASE_ID" ]; then
-            python3 -c "
-          import json, urllib.request
-          body = open('/dev/stdin').read()
-          payload = json.dumps({'body': body}).encode()
-          req = urllib.request.Request(
-              '${API_BASE}/releases/${RELEASE_ID}',
-              data=payload, method='PATCH',
-              headers={
-                  'Authorization': 'token ${TOKEN}',
-                  'Content-Type': 'application/json'
-              })
-          urllib.request.urlopen(req)
-          " <<< "$NOTES"
-            echo "Release notes updated from CHANGELOG.md"
-          fi
-
-          # Promote [Unreleased] → [version] in CHANGELOG.md and reset
-          if [ -n "$VERSION" ] && [ -f "CHANGELOG.md" ]; then
-            DATE=$(date +%Y-%m-%d)
-            python3 -c "
-          import sys
-          version, date = sys.argv[1], sys.argv[2]
-          content = open('CHANGELOG.md').read()
-          old = '## [Unreleased]'
-          new = f'## [Unreleased]\n\n## [{version}] --- {date}'
-          content = content.replace(old, new, 1)
-          open('CHANGELOG.md', 'w').write(content)
-          " "$VERSION" "$DATE"
-            git add CHANGELOG.md
-            git commit -m "chore: promote changelog [Unreleased] → [${VERSION}]" || true
-            git push origin main || true
-            echo "Changelog promoted: [Unreleased] → [${VERSION}]"
-          fi
-
-      # -- STEP 9: Mirror to GitHub (stable only) --------------------------------
-      - name: "Step 9: Mirror release to GitHub"
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          secrets.GH_MIRROR_TOKEN != ''
-        continue-on-error: true
-        run: |
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
-          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          php ${MOKO_CLI}/release_mirror.php \
-            --version "$VERSION" --tag "$RELEASE_TAG" \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
-            --gh-token "${{ secrets.GH_MIRROR_TOKEN }}" --gh-repo "$GH_REPO" \
-            --branch main 2>&1 || true
-          echo "GitHub mirror updated" >> $GITHUB_STEP_SUMMARY
-
-      # -- STEP 10: Sync main branch to GitHub mirror ----------------------------
-      - name: "Step 10: Push main to GitHub mirror"
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          secrets.GH_MIRROR_TOKEN != ''
-        continue-on-error: true
-        run: |
-          GH_REPO="${{ vars.GH_MIRROR_REPO || github.repository }}"
-          GH_ORG=$(echo "$GH_REPO" | cut -d/ -f1)
-          GH_NAME=$(echo "$GH_REPO" | cut -d/ -f2)
-          git remote add github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git" 2>/dev/null || \
-            git remote set-url github "https://x-access-token:${{ secrets.GH_MIRROR_TOKEN }}@github.com/${GH_ORG}/${GH_NAME}.git"
-          git fetch origin main --depth=1
-          git push github origin/main:refs/heads/main --force 2>/dev/null \
-            && echo "main branch pushed to GitHub mirror" \
-            || echo "WARNING: GitHub mirror push failed"
-
-      - name: "Step 11: Delete rc branch (dev reset moved to cascade-dev.yml)"
-        if: steps.version.outputs.skip != 'true'
-        continue-on-error: true
-        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-
-          # Delete rc branch (ephemeral — created by promote-rc)
-          curl -sf -X DELETE -H "Authorization: token ${TOKEN}" \
-            "${API_BASE}/branches/rc" 2>/dev/null \
-            && echo "Deleted rc branch" || echo "rc branch not found"
-
-          # dev is reset from main by the dedicated "Cascade Main -> Dev" workflow
-          # (cascade-dev.yml), which runs after this release completes.
-          echo "rc cleaned; dev reset handled by cascade-dev.yml" >> $GITHUB_STEP_SUMMARY
-
-      - name: "Step 12: Create version branch from main"
-        if: steps.version.outputs.skip != 'true'
-        continue-on-error: true
-        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          BRANCH_NAME="version/${VERSION}"
-          MAIN_SHA=$(git rev-parse HEAD)
-
-          # Delete old version branch if it exists (same version re-release)
-          curl -sf -X DELETE -H "Authorization: token ${TOKEN}"             "${API_BASE}/branches/${BRANCH_NAME}" 2>/dev/null && echo "Deleted old ${BRANCH_NAME}"
-
-          # Create version/XX.YY.ZZ from main
-          curl -sf -X POST -H "Authorization: token ${TOKEN}"             -H "Content-Type: application/json"             "${API_BASE}/branches"             -d "{\"new_branch_name\":\"${BRANCH_NAME}\",\"old_branch_name\":\"main\"}" 2>/dev/null             && echo "Created ${BRANCH_NAME} from main (${MAIN_SHA})"             || echo "WARNING: ${BRANCH_NAME} creation failed"
-
-          echo "Version branch created: ${BRANCH_NAME} (${MAIN_SHA})" >> $GITHUB_STEP_SUMMARY
-
-
-
-      # -- Dolibarr post-release: Reset dev version -----------------------------
-      - name: "Post-release: Reset dev version"
-        if: steps.version.outputs.skip != 'true'
-        continue-on-error: true
-        run: |
-          API_BASE="${MOKOGITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          php ${MOKO_CLI}/version_reset_dev.php \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "${API_BASE}" \
-            --branch dev --path . 2>&1 || true
-
-      # -- Summary --------------------------------------------------------------
-      - name: Pipeline Summary
-        if: always()
-        run: |
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          PLATFORM="${{ steps.platform.outputs.platform }}"
-          if [ "${{ steps.version.outputs.skip }}" = "true" ]; then
-            echo "## Release Skipped" >> $GITHUB_STEP_SUMMARY
-            echo "No VERSION in README.md" >> $GITHUB_STEP_SUMMARY
-          elif [ "${{ steps.check.outputs.already_released }}" = "true" ]; then
-            echo "## Already Released — ${VERSION}" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "## Build & Release Complete (${PLATFORM})" >> $GITHUB_STEP_SUMMARY
-            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "| Step | Result |" >> $GITHUB_STEP_SUMMARY
-            echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
-            echo "| Platform | \`${PLATFORM}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
-            echo "| Release | [View](${MOKOGITEA_URL}/${GITEA_ORG}/${GITEA_REPO}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
-          fi

.mokogitea/workflows/branch-cleanup.yml

@@ -1,49 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/branch-cleanup.yml
-# VERSION: 01.00.00
-# BRIEF: Delete feature branches after PR merge
-
-name: "Branch Cleanup"
-
-on:
-  pull_request:
-    types: [closed]
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  cleanup:
-    name: Delete merged branch
-    runs-on: ubuntu-latest
-    if: >-
-      github.event.pull_request.merged == true &&
-      github.event.pull_request.head.ref != 'dev' &&
-      github.event.pull_request.head.ref != 'main'
-
-    steps:
-      - name: Delete source branch
-        run: |
-          BRANCH="${{ github.event.pull_request.head.ref }}"
-          API="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}/api/v1/repos/${{ github.repository }}/branches"
-          # URL-encode the branch name's slashes (no PHP dependency on the runner)
-          ENCODED=$(printf '%s' "${BRANCH}" | sed 's|/|%2F|g')
-
-          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
-            -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
-            "${API}/${ENCODED}" 2>/dev/null || true)
-
-          if [ "$STATUS" = "204" ]; then
-            echo "Deleted branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
-          elif [ "$STATUS" = "404" ]; then
-            echo "Branch already deleted: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "::warning::Failed to delete branch ${BRANCH} (HTTP ${STATUS})"
-          fi

.mokogitea/workflows/cascade-dev.yml

@@ -1,106 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Cascade
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/cascade-dev.yml
-# VERSION: 02.00.00
-# BRIEF: Cascade main -> dev via PR; auto-merge only if conflict-free, else notify
-
-name: "Cascade Main -> Dev"
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-permissions:
-  contents: write
-  pull-requests: write
-
-env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  # ntfy destination is configured via repo or org variables (org vars are inherited).
-  NTFY_URL: ${{ vars.NTFY_URL || 'https://ntfy.mokoconsulting.tech' }}
-  NTFY_TOPIC: ${{ vars.CASCADE_NTFY_TOPIC || vars.NTFY_TOPIC || 'gitea-releases' }}
-
-jobs:
-  cascade:
-    name: Cascade main -> dev
-    runs-on: ubuntu-latest
-    steps:
-      - name: Open main -> dev PR (auto-merge if clean, else notify)
-        env:
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          REPO: ${{ github.repository }}
-        run: |
-          set -uo pipefail
-          API="${MOKOGITEA_URL}/api/v1/repos/${REPO}"
-          AUTH="Authorization: token ${TOKEN}"
-          jqnum() { python3 -c "import sys,json; d=json.load(sys.stdin); print(d.get('$1',''))" 2>/dev/null; }
-
-          # 0. dev must exist
-          if ! curl -sf -H "$AUTH" "${API}/branches/dev" >/dev/null 2>&1; then
-            echo "No dev branch - nothing to cascade."; exit 0
-          fi
-
-          # 1. is main ahead of dev?
-          AHEAD=$(curl -sf -H "$AUTH" "${API}/compare/dev...main" \
-            | python3 -c "import sys,json; print(json.load(sys.stdin).get('total_commits',0))" 2>/dev/null || echo 0)
-          if [ "${AHEAD:-0}" -eq 0 ]; then
-            echo "dev already up to date with main."; exit 0
-          fi
-          echo "main is ${AHEAD} commit(s) ahead of dev."
-
-          # 2. reuse an open main->dev PR, else create one
-          PR=$(curl -sf -H "$AUTH" "${API}/pulls?state=open&base=dev" \
-            | python3 -c "import sys,json; d=json.load(sys.stdin); print(next((str(p['number']) for p in d if p.get('head',{}).get('ref')=='main'), ''))" 2>/dev/null || echo "")
-          if [ -z "$PR" ]; then
-            RESP=$(curl -s -H "$AUTH" -H "Content-Type: application/json" -X POST "${API}/pulls" \
-              -d '{"head":"main","base":"dev","title":"chore(sync): cascade main -> dev","body":"Automated cascade of main into dev. Auto-merges only if conflict-free; otherwise left open for manual resolution."}')
-            PR=$(printf '%s' "$RESP" | jqnum number)
-            if [ -z "$PR" ]; then
-              echo "::warning::Could not open cascade PR: $RESP"; exit 0
-            fi
-            echo "Opened cascade PR #${PR}"
-          else
-            echo "Reusing open cascade PR #${PR}"
-          fi
-
-          # 3. wait for MokoGitea to compute mergeability (conflict detection)
-          MERGEABLE=""
-          for _ in 1 2 3 4 5 6; do
-            MERGEABLE=$(curl -sf -H "$AUTH" "${API}/pulls/${PR}" | jqnum mergeable)
-            case "$MERGEABLE" in True|False) break ;; esac
-            sleep 3
-          done
-          echo "mergeable=${MERGEABLE}"
-
-          notify() {
-            curl -sS \
-              -H "Title: ${REPO}: dev cascade needs manual merge" \
-              -H "Tags: warning,twisted_rightwards_arrows" \
-              -H "Priority: high" \
-              -H "Click: ${MOKOGITEA_URL}/${REPO}/pulls/${PR}" \
-              -d "main -> dev cascade PR #${PR} $1 It was NOT auto-merged; resolve it manually." \
-              "${NTFY_URL}/${NTFY_TOPIC}" || true
-          }
-
-          # 4. auto-merge only if conflict-free; otherwise notify
-          if [ "$MERGEABLE" = "True" ]; then
-            CODE=$(curl -s -o /tmp/merge.json -w "%{http_code}" -H "$AUTH" -H "Content-Type: application/json" \
-              -X POST "${API}/pulls/${PR}/merge" -d '{"Do":"merge","merge_when_checks_succeed":true}')
-            if [ "$CODE" -ge 200 ] && [ "$CODE" -lt 300 ]; then
-              echo "Cascade PR #${PR} merged (or scheduled to merge when checks pass)."
-            else
-              echo "::warning::Auto-merge returned HTTP ${CODE}: $(cat /tmp/merge.json)"
-              notify "could not be auto-merged (HTTP ${CODE})."
-            fi
-          else
-            echo "::warning::Cascade PR #${PR} has conflicts (mergeable=${MERGEABLE}); sending notification."
-            notify "has conflicts and cannot be merged automatically."
-          fi

.mokogitea/workflows/ci-generic.yml

@@ -1,202 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.CI
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/ci-generic.yml
-# VERSION: 01.00.00
-# BRIEF: CI pipeline — lint, validate, and test for generic projects (PHP + Node.js)
-
-name: "Generic: Project CI"
-
-on:
-  pull_request:
-    branches:
-      - main
-      - dev
-      - dev/**
-      - rc/**
-  workflow_dispatch:
-
-permissions:
-  contents: read
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  # ── Lint & Validate ───────────────────────────────────────────────────
-  lint:
-    name: Lint & Validate
-    runs-on: ubuntu-latest
-    # Skip on template repos (Template-*) — they hold placeholder scaffolding, not buildable source.
-    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Detect toolchain
-        id: detect
-        run: |
-          HAS_PHP=false
-          HAS_NODE=false
-          [ -f "composer.json" ] && HAS_PHP=true
-          [ -f "package.json" ] && HAS_NODE=true
-          echo "has_php=$HAS_PHP" >> "$GITHUB_OUTPUT"
-          echo "has_node=$HAS_NODE" >> "$GITHUB_OUTPUT"
-          echo "Toolchain: PHP=$HAS_PHP Node=$HAS_NODE"
-
-      - name: Setup PHP
-        if: steps.detect.outputs.has_php == 'true'
-        run: |
-          if ! command -v php &> /dev/null; then
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq php-cli php-mbstring php-xml >/dev/null 2>&1
-          fi
-          php -v
-
-      - name: Setup Node.js
-        if: steps.detect.outputs.has_node == 'true'
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
-      - name: Install PHP dependencies
-        if: steps.detect.outputs.has_php == 'true'
-        run: |
-          if [ -f "composer.json" ]; then
-            composer install --no-interaction --prefer-dist --quiet 2>/dev/null || true
-          fi
-
-      - name: Install Node.js dependencies
-        if: steps.detect.outputs.has_node == 'true'
-        run: |
-          if [ -f "package.json" ]; then
-            npm ci --quiet 2>/dev/null || npm install --quiet 2>/dev/null || true
-          fi
-
-      - name: PHP syntax check
-        if: steps.detect.outputs.has_php == 'true'
-        run: |
-          ERRORS=0
-          while IFS= read -r -d '' file; do
-            if ! php -l "$file" 2>&1 | grep -q "No syntax errors"; then
-              echo "::error file=${file}::PHP syntax error"
-              ERRORS=$((ERRORS + 1))
-            fi
-          done < <(find . -name "*.php" -not -path "./.git/*" -not -path "./vendor/*" -not -path "./node_modules/*" -print0)
-
-          echo "## PHP Lint" >> $GITHUB_STEP_SUMMARY
-          if [ "$ERRORS" -eq 0 ]; then
-            echo "All PHP files passed syntax check." >> $GITHUB_STEP_SUMMARY
-          else
-            echo "${ERRORS} file(s) with syntax errors." >> $GITHUB_STEP_SUMMARY
-            exit 1
-          fi
-
-      - name: TypeScript/JavaScript lint
-        if: steps.detect.outputs.has_node == 'true'
-        run: |
-          if [ -f "node_modules/.bin/eslint" ]; then
-            npx eslint src/ --quiet 2>&1 || { echo "::error::ESLint errors found"; exit 1; }
-            echo "## ESLint" >> $GITHUB_STEP_SUMMARY
-            echo "All files passed ESLint." >> $GITHUB_STEP_SUMMARY
-          elif [ -f ".eslintrc.json" ] || [ -f ".eslintrc.js" ] || [ -f "eslint.config.js" ]; then
-            echo "::warning::ESLint config found but eslint not installed"
-          else
-            echo "No ESLint configured — skipping"
-          fi
-
-      - name: TypeScript compile check
-        if: steps.detect.outputs.has_node == 'true'
-        run: |
-          if [ -f "tsconfig.json" ] && [ -f "node_modules/.bin/tsc" ]; then
-            npx tsc --noEmit 2>&1 || { echo "::error::TypeScript compilation errors"; exit 1; }
-            echo "## TypeScript" >> $GITHUB_STEP_SUMMARY
-            echo "TypeScript compilation passed." >> $GITHUB_STEP_SUMMARY
-          fi
-
-      - name: PHPStan static analysis
-        if: steps.detect.outputs.has_php == 'true'
-        run: |
-          if [ -f "phpstan.neon" ] && [ -f "vendor/bin/phpstan" ]; then
-            vendor/bin/phpstan analyse --no-progress 2>&1 || { echo "::warning::PHPStan found issues"; }
-          fi
-
-  # ── Tests ─────────────────────────────────────────────────────────────
-  test:
-    name: Tests
-    runs-on: ubuntu-latest
-    needs: lint
-    # Run only when lint succeeded; always() forces evaluation so a skipped
-    # lint (e.g. template repos) skips this job cleanly instead of hanging.
-    if: ${{ always() && needs.lint.result == 'success' }}
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Detect toolchain
-        id: detect
-        run: |
-          HAS_PHP=false
-          HAS_NODE=false
-          [ -f "composer.json" ] && HAS_PHP=true
-          [ -f "package.json" ] && HAS_NODE=true
-          echo "has_php=$HAS_PHP" >> "$GITHUB_OUTPUT"
-          echo "has_node=$HAS_NODE" >> "$GITHUB_OUTPUT"
-
-      - name: Setup PHP
-        if: steps.detect.outputs.has_php == 'true'
-        run: |
-          if ! command -v php &> /dev/null; then
-            sudo apt-get update -qq
-            sudo apt-get install -y -qq php-cli php-mbstring php-xml >/dev/null 2>&1
-          fi
-
-      - name: Setup Node.js
-        if: steps.detect.outputs.has_node == 'true'
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-
-      - name: Install dependencies
-        run: |
-          [ -f "composer.json" ] && composer install --no-interaction --prefer-dist --quiet 2>/dev/null || true
-          [ -f "package.json" ] && { npm ci --quiet 2>/dev/null || npm install --quiet 2>/dev/null || true; }
-
-      - name: Run PHP tests
-        if: steps.detect.outputs.has_php == 'true'
-        run: |
-          if [ -f "vendor/bin/phpunit" ]; then
-            vendor/bin/phpunit --testdox 2>&1
-            echo "## PHPUnit" >> $GITHUB_STEP_SUMMARY
-            echo "Tests passed." >> $GITHUB_STEP_SUMMARY
-          elif [ -f "phpunit.xml" ] || [ -f "phpunit.xml.dist" ]; then
-            echo "::warning::PHPUnit config found but phpunit not installed"
-          else
-            echo "No PHPUnit configured — skipping"
-          fi
-
-      - name: Run Node.js tests
-        if: steps.detect.outputs.has_node == 'true'
-        run: |
-          if jq -e '.scripts.test' package.json > /dev/null 2>&1; then
-            npm test 2>&1
-            echo "## Node.js Tests" >> $GITHUB_STEP_SUMMARY
-            echo "Tests passed." >> $GITHUB_STEP_SUMMARY
-          else
-            echo "No test script in package.json — skipping"
-          fi
-
-      - name: Build check
-        run: |
-          if [ -f "Makefile" ]; then
-            make build 2>&1 || echo "::warning::Build failed or not configured"
-          elif [ -f "package.json" ] && jq -e '.scripts.build' package.json > /dev/null 2>&1; then
-            npm run build 2>&1 || echo "::warning::Build failed"
-          fi

.mokogitea/workflows/ci-issue-reporter.yml

@@ -1,68 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/ci-issue-reporter.yml
-# VERSION: 01.00.00
-# BRIEF: Reusable workflow — creates/updates a MokoGitea issue when a CI gate fails.
-#        Clones MokoCLI and runs cli/ci_issue_reporter.sh.
-
-name: "Universal: CI Issue Reporter"
-
-on:
-  workflow_call:
-    inputs:
-      gate:
-        description: "CI gate name (e.g. PR Validation, Repository Health)"
-        required: true
-        type: string
-      details:
-        description: "Human-readable failure description"
-        required: true
-        type: string
-      severity:
-        description: "error or warning"
-        required: false
-        type: string
-        default: "error"
-      workflow:
-        description: "Workflow name for the issue title"
-        required: false
-        type: string
-        default: ""
-    secrets:
-      MOKOGITEA_TOKEN:
-        required: true
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  report:
-    name: "Report: ${{ inputs.gate }}"
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Clone MokoCLI
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 --filter=blob:none --sparse "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
-          cd /tmp/mokocli && git sparse-checkout set cli/ci_issue_reporter.sh
-
-      - name: Report CI failure
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-          MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-        run: |
-          chmod +x /tmp/mokocli/cli/ci_issue_reporter.sh
-          /tmp/mokocli/cli/ci_issue_reporter.sh \
-            --gate "${{ inputs.gate }}" \
-            --details "${{ inputs.details }}" \
-            --severity "${{ inputs.severity }}" \
-            --workflow "${{ inputs.workflow }}"

.mokogitea/workflows/cleanup.yml

@@ -1,87 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: MokoStandards.Maintenance
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/MokoStandards
-# PATH: /.mokogitea/workflows/cleanup.yml
-# VERSION: 01.00.00
-# BRIEF: Scheduled cleanup — delete merged branches and old workflow runs
-
-name: "Universal: Repository Cleanup"
-
-on:
-  schedule:
-    - cron: '0 3 * * 0'  # Weekly on Sunday at 03:00 UTC
-  workflow_dispatch:
-
-permissions:
-  contents: write
-
-env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-
-jobs:
-  cleanup:
-    name: Clean Merged Branches
-    runs-on: ubuntu-latest
-
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
-
-      - name: Delete merged branches
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          echo "=== Merged Branch Cleanup ==="
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
-
-          # List branches via API
-          BRANCHES=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
-            "${API}/branches?limit=50" | jq -r '.[].name')
-
-          DELETED=0
-          for BRANCH in $BRANCHES; do
-            # Skip protected branches
-            case "$BRANCH" in
-              main|master|dev|develop|rc|beta|alpha|release|release/*|production|stable|staging|hotfix/*|version/*) continue ;;
-            esac
-
-            # Check if branch is merged into main
-            if git merge-base --is-ancestor "origin/${BRANCH}" origin/main 2>/dev/null; then
-              echo "  Deleting merged branch: ${BRANCH}"
-              curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
-                "${API}/branches/${BRANCH}" 2>/dev/null || true
-              DELETED=$((DELETED + 1))
-            fi
-          done
-
-          echo "Deleted ${DELETED} merged branch(es)"
-
-      - name: Clean old workflow runs
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          echo "=== Workflow Run Cleanup ==="
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
-          CUTOFF=$(date -d "30 days ago" +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -v-30d +%Y-%m-%dT%H:%M:%SZ)
-
-          # Get old completed runs
-          RUNS=$(curl -sS -H "Authorization: token ${MOKOGITEA_TOKEN}" \
-            "${API}/actions/runs?status=completed&limit=50" | \
-            jq -r ".workflow_runs[] | select(.created_at < \"${CUTOFF}\") | .id" 2>/dev/null)
-
-          DELETED=0
-          for RUN_ID in $RUNS; do
-            curl -sS -X DELETE -H "Authorization: token ${MOKOGITEA_TOKEN}" \
-              "${API}/actions/runs/${RUN_ID}" 2>/dev/null || true
-            DELETED=$((DELETED + 1))
-          done
-
-          echo "Deleted ${DELETED} old workflow run(s)"

.mokogitea/workflows/issue-branch.yml

@@ -1,73 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Automation
-# VERSION: 01.00.00
-# BRIEF: Auto-create feature branch when an issue is opened
-
-name: "Universal: Issue Branch"
-
-on:
-  issues:
-    types: [opened]
-
-permissions:
-  contents: write
-  issues: write
-
-env:
-  MOKOGITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-
-jobs:
-  create-branch:
-    name: Create feature branch
-    runs-on: ubuntu-latest
-    steps:
-      - name: Create branch and comment
-        run: |
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-          API="${MOKOGITEA_URL}/api/v1/repos/${{ github.repository }}"
-          ISSUE_NUM="${{ github.event.issue.number }}"
-          ISSUE_TITLE="${{ github.event.issue.title }}"
-
-          # Build slug from title: lowercase, replace non-alnum with dash, trim
-          SLUG=$(echo "${ISSUE_TITLE}" | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g' | sed 's/--*/-/g' | sed 's/^-//;s/-$//' | cut -c1-40)
-          BRANCH="feature/${ISSUE_NUM}-${SLUG}"
-
-          # Check dev branch exists
-          DEV_EXISTS=$(curl -sf -o /dev/null -w '%{http_code}' \
-            -H "Authorization: token ${TOKEN}" \
-            "${API}/branches/dev" 2>/dev/null || echo "000")
-
-          if [ "${DEV_EXISTS}" != "200" ]; then
-            echo "No dev branch -- skipping"
-            exit 0
-          fi
-
-          # Create branch from dev
-          HTTP=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
-            -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/json" \
-            "${API}/branches" \
-            -d "{\"new_branch_name\":\"${BRANCH}\",\"old_branch_name\":\"dev\"}" 2>/dev/null || echo "000")
-
-          if [ "${HTTP}" = "201" ]; then
-            echo "Created branch: ${BRANCH}"
-
-            # Comment on issue with branch link
-            REPO_URL="${MOKOGITEA_URL}/${{ github.repository }}"
-            BODY="Branch created: [\`${BRANCH}\`](${REPO_URL}/src/branch/${BRANCH})\n\n\`\`\`bash\ngit fetch origin\ngit checkout ${BRANCH}\n\`\`\`"
-
-            curl -sf -X POST \
-              -H "Authorization: token ${TOKEN}" \
-              -H "Content-Type: application/json" \
-              "${API}/issues/${ISSUE_NUM}/comments" \
-              -d "{\"body\":\"${BODY}\"}" > /dev/null 2>&1
-
-            echo "Commented on issue #${ISSUE_NUM}"
-          else
-            echo "Failed to create branch (HTTP ${HTTP}) -- may already exist"
-          fi

.mokogitea/workflows/npm-publish.yml

@@ -1,113 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-# SPDX-License-Identifier: GPL-3.0-or-later
-
-name: "Publish to npm"
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-env:
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
-
-jobs:
-  publish:
-    runs-on: ubuntu-latest
-    if: >-
-      !contains(github.event.head_commit.message, '[skip ci]') &&
-      !contains(github.event.head_commit.message, '[skip publish]')
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '20'
-          registry-url: 'https://registry.npmjs.org'
-
-      - name: Install dependencies
-        run: npm install
-
-      - name: Build
-        run: npm run build
-
-      - name: Auto-bump patch version
-        run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          TOKEN="${{ secrets.MOKOGITEA_TOKEN }}"
-
-          PKG_NAME=$(node -p "require('./package.json').name")
-          CURRENT=$(node -p "require('./package.json').version")
-          PUBLISHED=$(npm view "${PKG_NAME}@latest" version 2>/dev/null || echo "0.0.0")
-
-          if [ "$CURRENT" != "$PUBLISHED" ]; then
-            echo "Version ${CURRENT} not yet published, using as-is."
-            exit 0
-          fi
-
-          # Bump locally to get the new version
-          npm version patch --no-git-tag-version
-          NEW_VER=$(node -p "require('./package.json').version")
-          echo "Bumping ${CURRENT} -> ${NEW_VER}"
-
-          # Push via Gitea API: branch + PR + merge
-          BRANCH="chore/npm-version-bump"
-          FILEPATH="package.json"
-          CONTENT=$(base64 -w 0 < package.json)
-          COMMIT_MSG="chore: bump to ${NEW_VER} [skip ci]"
-
-          # Get current file SHA on main
-          FILE_SHA=$(curl -sf -H "Authorization: token ${TOKEN}" \
-            "${API_BASE}/contents/${FILEPATH}?ref=main" \
-            | python3 -c "import json,sys; print(json.load(sys.stdin).get('sha',''))" 2>/dev/null || true)
-
-          # Create chore branch from main
-          curl -sf -X POST -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/json" \
-            "${API_BASE}/branches" \
-            -d "{\"new_branch_name\":\"${BRANCH}\",\"old_branch_name\":\"main\"}" 2>/dev/null || true
-
-          # Get file SHA on chore branch (may differ if branch already existed)
-          BRANCH_SHA=$(curl -sf -H "Authorization: token ${TOKEN}" \
-            "${API_BASE}/contents/${FILEPATH}?ref=${BRANCH}" \
-            | python3 -c "import json,sys; print(json.load(sys.stdin).get('sha',''))" 2>/dev/null || true)
-          [ -n "$BRANCH_SHA" ] && FILE_SHA="$BRANCH_SHA"
-
-          # Push package.json to chore branch
-          PAYLOAD="{\"content\":\"${CONTENT}\",\"message\":\"${COMMIT_MSG}\",\"branch\":\"${BRANCH}\",\"sha\":\"${FILE_SHA}\"}"
-          HTTP=$(curl -sf -o /dev/null -w "%{http_code}" -X PUT \
-            -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "$PAYLOAD" \
-            "${API_BASE}/contents/${FILEPATH}" 2>/dev/null || echo "ERR")
-          echo "File push: HTTP ${HTTP}"
-
-          # Create PR
-          PR_NUM=$(curl -sf -X POST -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/json" \
-            "${API_BASE}/pulls" \
-            -d "{\"title\":\"${COMMIT_MSG}\",\"head\":\"${BRANCH}\",\"base\":\"main\"}" \
-            | python3 -c "import json,sys; print(json.load(sys.stdin).get('number',''))" 2>/dev/null || true)
-
-          if [ -n "$PR_NUM" ]; then
-            # Merge PR
-            curl -sf -X POST -H "Authorization: token ${TOKEN}" \
-              -H "Content-Type: application/json" \
-              "${API_BASE}/pulls/${PR_NUM}/merge" \
-              -d "{\"Do\":\"merge\",\"merge_message_field\":\"${COMMIT_MSG}\"}" 2>/dev/null
-            echo "Version bumped via PR #${PR_NUM} (merged)"
-          else
-            echo "::warning::Could not create PR for version bump — publishing with current version"
-          fi
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
-
-      - name: Publish
-        run: npm publish --access public
-        env:
-          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

.mokogitea/workflows/pre-release.yml

@@ -3,11 +3,11 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
+# DEFGROUP: Gitea.Workflow
-# INGROUP: mokocli.Release
+# INGROUP: moko-platform.Release
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
-# PATH: /.mokogitea/workflows/pre-release.yml
+# PATH: /templates/workflows/universal/pre-release.yml.template
-# VERSION: 05.02.00
+# VERSION: 05.01.00
 # BRIEF: Auto pre-release on push to dev/alpha/beta/rc branches
 
 name: "Universal: Pre-Release"
@@ -48,13 +48,9 @@ jobs:
   build:
     name: "Build Pre-Release (${{ inputs.stability || github.ref_name }})"
     runs-on: release
-    # Skip on template repos (Template-*) — they scaffold other repos and do not release.
     if: >-
-      !startsWith(github.event.repository.name, 'Template-') &&
+      github.event_name == 'workflow_dispatch' ||
-      (
+      github.event_name == 'push'
-        github.event_name == 'workflow_dispatch' ||
-        github.event_name == 'push'
-      )
 
     steps:
       - name: Checkout
@@ -63,31 +59,26 @@ jobs:
           fetch-depth: 0
           token: ${{ secrets.MOKOGITEA_TOKEN }}
           ref: ${{ github.ref_name }}
-          submodules: recursive
 
-      - name: Update submodules to main
+      - name: Setup moko-platform tools
-        run: |
-          git submodule foreach --quiet 'git checkout main && git pull --quiet origin main' 2>/dev/null || true
-
-      - name: Setup mokocli tools
         env:
           MOKO_CLONE_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
           MOKO_CLONE_HOST: git.mokoconsulting.tech/MokoConsulting
         run: |
-          # Use pre-installed /opt/mokocli if available (updated by cron every 6h)
+          # Use pre-installed /opt/moko-platform if available (updated by cron every 6h)
-          if [ -f /opt/mokocli/cli/version_bump.php ] && [ -f /opt/mokocli/cli/manifest_element.php ] && [ -f /opt/mokocli/vendor/autoload.php ]; then
+          if [ -f /opt/moko-platform/cli/version_bump.php ] && [ -f /opt/moko-platform/cli/manifest_element.php ] && [ -f /opt/moko-platform/vendor/autoload.php ]; then
-            echo Using pre-installed /opt/mokocli
+            echo Using pre-installed /opt/moko-platform
-            echo MOKO_CLI=/opt/mokocli/cli >> $GITHUB_ENV
+            echo MOKO_CLI=/opt/moko-platform/cli >> $GITHUB_ENV
           else
             echo Falling back to fresh clone
             if ! command -v composer > /dev/null 2>&1; then
               sudo apt-get update -qq && sudo apt-get install -y -qq php-cli php-mbstring php-xml php-zip php-curl composer > /dev/null 2>&1
             fi
-            rm -rf /tmp/mokocli
+            rm -rf /tmp/moko-platform-api
-            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/MokoCLI.git
+            CLONE_URL=https://x-access-token:${MOKO_CLONE_TOKEN}@${MOKO_CLONE_HOST}/moko-platform.git
-            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/mokocli
+            git clone --depth 1 --branch main --quiet $CLONE_URL /tmp/moko-platform-api
-            cd /tmp/mokocli && composer install --no-dev --no-interaction --quiet
+            cd /tmp/moko-platform-api && composer install --no-dev --no-interaction --quiet
-            echo MOKO_CLI=/tmp/mokocli/cli >> $GITHUB_ENV
+            echo MOKO_CLI=/tmp/moko-platform-api/cli >> $GITHUB_ENV
           fi
 
       - name: Detect platform
@@ -97,20 +88,8 @@ jobs:
           php ${MOKO_CLI}/platform_detect.php --path . --github-output 2>/dev/null || true
           php ${MOKO_CLI}/manifest_read.php --path . --github-output
 
-      - name: Check platform eligibility (Joomla only)
-        id: eligibility
-        run: |
-          PLATFORM="${{ steps.platform.outputs.platform }}"
-          if [[ "$PLATFORM" == joomla* ]] || [[ "$PLATFORM" == "joomla" ]]; then
-            echo "proceed=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "proceed=false" >> "$GITHUB_OUTPUT"
-            echo "::notice::Platform '$PLATFORM' — non-Joomla, skipping pre-release auto-bump"
-          fi
-
       - name: Resolve metadata and bump version
         id: meta
-        if: steps.eligibility.outputs.proceed == 'true'
         run: |
           # Auto-detect stability from branch name on push, or use input on dispatch
           if [ "${{ github.event_name }}" = "push" ]; then
@@ -156,8 +135,8 @@ jobs:
           fi
 
           # Commit version bump
-          git config --local user.email "mokogitea-actions[bot]@mokoconsulting.tech"
+          git config --local user.email "gitea-actions[bot]@mokoconsulting.tech"
-          git config --local user.name "mokogitea-actions[bot]"
+          git config --local user.name "gitea-actions[bot]"
           git remote set-url origin "https://x-access-token:${{ secrets.MOKOGITEA_TOKEN }}@git.mokoconsulting.tech/${{ github.repository }}.git"
           git add -A
           git diff --cached --quiet || {
@@ -187,7 +166,6 @@ jobs:
 
       - name: Create release
         id: release
-        if: steps.eligibility.outputs.proceed == 'true'
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
           VERSION="${{ steps.meta.outputs.version }}"
@@ -198,7 +176,6 @@ jobs:
             --repo "${GITEA_REPO}" --branch "${{ github.ref_name }}" --prerelease
 
       - name: Update release notes from CHANGELOG.md
-        if: steps.eligibility.outputs.proceed == 'true'
         run: |
           TAG="${{ steps.meta.outputs.tag }}"
           VERSION="${{ steps.meta.outputs.version }}"
@@ -235,7 +212,6 @@ jobs:
 
       - name: Build package and upload
         id: package
-        if: steps.eligibility.outputs.proceed == 'true'
         run: |
           VERSION="${{ steps.meta.outputs.version }}"
           TAG="${{ steps.meta.outputs.tag }}"
@@ -249,7 +225,6 @@ jobs:
       # No need to build, commit, or sync updates.xml from workflows
 
       - name: "Delete lesser pre-release channels (cascade)"
-        if: steps.eligibility.outputs.proceed == 'true'
         continue-on-error: true
         run: |
           API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"

.mokogitea/workflows/rc-revert.yml

@@ -1,72 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/rc-revert.yml
-# VERSION: 09.23.00
-# BRIEF: Rename rc/ branch back to dev/ when PR is closed without merge
-
-name: "RC Revert"
-
-on:
-  pull_request:
-    types: [closed]
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  revert:
-    name: Rename rc/ back to dev/
-    runs-on: ubuntu-latest
-    if: >-
-      github.event.pull_request.merged == false &&
-      startsWith(github.event.pull_request.head.ref, 'rc/') &&
-      !startsWith(github.event.repository.name, 'Template-')
-
-    steps:
-      - name: Rename branch
-        env:
-          BRANCH: ${{ github.event.pull_request.head.ref }}
-          REPO: ${{ github.repository }}
-          GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-          TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          set -euo pipefail
-          # BRANCH is attacker-controlled (PR head ref). Strict allowlist before ANY use.
-          if ! printf '%s' "$BRANCH" | grep -Eq '^rc/[A-Za-z0-9._/-]+$'; then
-            echo "::error::Refusing unsafe branch name: $BRANCH"; exit 1
-          fi
-          SUFFIX="${BRANCH#rc/}"
-          DEV_BRANCH="dev/${SUFFIX}"
-          API="${GITEA_URL}/api/v1/repos/${REPO}/branches"
-
-          # Create dev/ branch from rc/ branch
-          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X POST \
-            -H "Authorization: token ${TOKEN}" \
-            -H "Content-Type: application/json" \
-            -d "{\"new_branch_name\": \"${DEV_BRANCH}\", \"old_branch_name\": \"${BRANCH}\"}" \
-            "${API}" 2>/dev/null || true)
-          if [ "$STATUS" = "201" ]; then
-            echo "Created branch: ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "::error::Failed to create ${DEV_BRANCH} from ${BRANCH} (HTTP ${STATUS})"; exit 1
-          fi
-
-          # Read BRANCH from the environment inside PHP (getenv, no string interpolation -> no PHP injection)
-          ENCODED=$(php -r 'echo rawurlencode(getenv("BRANCH"));')
-          STATUS=$(curl -sf -o /dev/null -w "%{http_code}" -X DELETE \
-            -H "Authorization: token ${TOKEN}" \
-            "${API}/${ENCODED}" 2>/dev/null || true)
-          if [ "$STATUS" = "204" ]; then
-            echo "Deleted branch: ${BRANCH}" >> "$GITHUB_STEP_SUMMARY"
-          else
-            echo "::warning::Failed to delete ${BRANCH} (HTTP ${STATUS})"
-          fi
-
-          echo "### RC Reverted" >> "$GITHUB_STEP_SUMMARY"
-          echo "${BRANCH} → ${DEV_BRANCH}" >> "$GITHUB_STEP_SUMMARY"

.mokogitea/workflows/sync-on-merge.yml

@@ -1,32 +0,0 @@
-name: Sync Workflows to Repos
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - '.mokogitea/workflows/**'
-
-jobs:
-  sync:
-    runs-on: ubuntu-latest
-    if: ${{ startsWith(github.event.repository.name, 'Template-') }}
-    steps:
-      - name: Checkout mokocli
-        uses: actions/checkout@v4
-        with:
-          repository: MokoConsulting/MokoCLI
-          token: ${{ secrets.MOKOGITEA_TOKEN }}
-
-      - name: Setup PHP
-        uses: https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/raw/branch/main/actions/setup-php@v1
-        with:
-          php-version: '8.1'
-
-      - name: Install dependencies
-        run: composer install --no-dev --no-interaction
-
-      - name: Sync workflows to generic repos
-        run: php automation/bulk_sync.php --platform generic --org MokoConsulting --workflows-only --auto-merge --token "${{ secrets.MOKOGITEA_TOKEN }}"
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}

.mokogitea/workflows/version-set.yml

@@ -1,131 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow.Template
-# INGROUP: MokoStandards.CI
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Joomla
-# PATH: /.mokogitea/workflows/version-set.yml
-# VERSION: 01.00.00
-# BRIEF: Set or reset the extension version across all version-bearing files
-
-name: "Joomla: Set Version"
-
-on:
-  workflow_dispatch:
-    inputs:
-      version:
-        description: "Version number (e.g. 01.00.00)"
-        required: true
-        type: string
-      branch:
-        description: "Branch to update (default: current)"
-        required: false
-        type: string
-
-permissions:
-  contents: write
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  set-version:
-    name: Set Version to ${{ inputs.version }}
-    runs-on: ubuntu-latest
-    if: ${{ !startsWith(github.event.repository.name, 'Template-') }}
-
-    steps:
-      - name: Validate version format
-        run: |
-          VERSION="${{ inputs.version }}"
-          if ! echo "$VERSION" | grep -qP '^\d{2}\.\d{2}\.\d{2}$'; then
-            echo "::error::Invalid version format '${VERSION}' — expected XX.YY.ZZ (e.g. 01.00.00)"
-            exit 1
-          fi
-          echo "VERSION=${VERSION}" >> "$GITHUB_ENV"
-
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          token: ${{ secrets.MOKOGITEA_TOKEN || github.token }}
-          ref: ${{ inputs.branch || github.ref }}
-          fetch-depth: 1
-
-      - name: Update manifest version
-        run: |
-          MANIFEST=""
-          for XML_FILE in $(find . -maxdepth 3 -name "*.xml" -not -path "./.git/*" -not -path "./vendor/*"); do
-            if grep -q "<extension" "$XML_FILE" 2>/dev/null; then
-              MANIFEST="$XML_FILE"
-              break
-            fi
-          done
-
-          if [ -z "$MANIFEST" ]; then
-            echo "::warning::No Joomla extension manifest found — skipping manifest update"
-          else
-            OLD_VER=$(grep -oP '<version>\K[^<]+' "$MANIFEST" | head -1)
-            sed -i "s|<version>${OLD_VER}</version>|<version>${VERSION}</version>|" "$MANIFEST"
-            echo "Manifest: ${OLD_VER} → ${VERSION} (${MANIFEST})"
-          fi
-
-      - name: Update README.md version
-        run: |
-          if [ -f "README.md" ]; then
-            if grep -qP '^\s*VERSION:\s*\d' README.md; then
-              sed -i -E "s/(VERSION:\s*)[0-9]{2}\.[0-9]{2}\.[0-9]{2}/\1${VERSION}/" README.md
-              echo "README.md version updated to ${VERSION}"
-            else
-              echo "::warning::No VERSION line found in README.md — skipping"
-            fi
-          fi
-
-      - name: Update CHANGELOG.md
-        run: |
-          if [ -f "CHANGELOG.md" ]; then
-            DATE=$(date +%Y-%m-%d)
-            # Check if this version already has an entry
-            if grep -q "^\#\# \[${VERSION}\]" CHANGELOG.md; then
-              echo "CHANGELOG.md already has entry for ${VERSION} — skipping"
-            else
-              # Insert new version entry after [Unreleased] or at the top after header
-              if grep -q '^\#\# \[Unreleased\]' CHANGELOG.md; then
-                sed -i "/^\#\# \[Unreleased\]/a\\\\n## [${VERSION}] --- ${DATE}" CHANGELOG.md
-              else
-                sed -i "/^\# Changelog/a\\\\n## [Unreleased]\n\n## [${VERSION}] --- ${DATE}" CHANGELOG.md
-              fi
-              echo "CHANGELOG.md: added entry for ${VERSION}"
-            fi
-          else
-            echo "::warning::No CHANGELOG.md found — skipping"
-          fi
-
-      - name: Update FILE INFORMATION blocks
-        run: |
-          # Update VERSION in file header blocks (# VERSION: XX.YY.ZZ)
-          find . -maxdepth 1 -type f \( -name "*.yml" -o -name "*.yaml" -o -name "*.php" -o -name "*.md" \) \
-            -not -path "./.git/*" -not -path "./vendor/*" -print0 2>/dev/null | \
-          while IFS= read -r -d '' FILE; do
-            if head -20 "$FILE" | grep -qP '^\s*#?\s*VERSION:\s*\d{2}\.\d{2}\.\d{2}'; then
-              sed -i -E "s/(#?\s*VERSION:\s*)[0-9]{2}\.[0-9]{2}\.[0-9]{2}/\1${VERSION}/" "$FILE"
-              echo "Updated FILE INFORMATION VERSION in ${FILE}"
-            fi
-          done
-
-      - name: Commit and push
-        run: |
-          git config user.name "Moko Consulting [bot]"
-          git config user.email "hello@mokoconsulting.tech"
-          git add -A
-          if git diff --cached --quiet; then
-            echo "No version changes detected — nothing to commit"
-          else
-            git commit -m "chore: set version to ${VERSION} [skip bump]
-
-Authored-by: Moko Consulting"
-            git push
-            echo "### Version Set" >> $GITHUB_STEP_SUMMARY
-            echo "Version updated to \`${VERSION}\` on branch \`${GITHUB_REF_NAME}\`" >> $GITHUB_STEP_SUMMARY
-          fi

.mokogitea/workflows/workflow-sync-trigger.yml

@@ -1,82 +0,0 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: MokoGitea.Workflow
-# INGROUP: mokocli.Universal
-# REPO: https://git.mokoconsulting.tech/MokoConsulting/Template-Generic
-# PATH: /.mokogitea/workflows/workflow-sync-trigger.yml
-# VERSION: 01.01.00
-# BRIEF: Trigger workflow sync to live repos when a PR is merged to main
-
-name: "Universal: Workflow Sync Trigger"
-
-on:
-  workflow_dispatch:
-  pull_request:
-    types: [closed]
-    branches:
-      - main
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-
-jobs:
-  sync:
-    name: Sync workflows to live repos
-    runs-on: ubuntu-latest
-    if: >-
-      startsWith(github.event.repository.name, 'Template-') &&
-      (github.event_name == 'workflow_dispatch' ||
-      (github.event.pull_request.merged == true &&
-      !contains(github.event.pull_request.title, '[skip sync]')))
-
-    steps:
-      - name: Determine platform from repo name
-        id: platform
-        run: |
-          REPO="${{ github.event.repository.name }}"
-          case "$REPO" in
-            Template-Joomla)   PLATFORM="joomla" ;;
-            Template-Dolibarr) PLATFORM="dolibarr" ;;
-            Template-Go)       PLATFORM="go" ;;
-            Template-MCP)      PLATFORM="mcp" ;;
-            Template-Generic)  PLATFORM="" ;;
-            *)                 PLATFORM="" ;;
-          esac
-          echo "platform=$PLATFORM" >> "$GITHUB_OUTPUT"
-          echo "Platform: ${PLATFORM:-all}"
-
-      - name: Clone mokocli
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          MOKOGITEA_URL="${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}"
-          git clone --depth 1 "${MOKOGITEA_URL}/MokoConsulting/MokoCLI.git" /tmp/mokocli
-
-      - name: Install PHP
-        run: |
-          if ! command -v php &> /dev/null; then
-            apt-get update -qq && apt-get install -y -qq php-cli php-json php-curl > /dev/null 2>&1
-          fi
-
-      - name: Install dependencies
-        run: |
-          cd /tmp/mokocli
-          composer install --no-dev --no-interaction --quiet 2>/dev/null || true
-
-      - name: Run workflow sync
-        env:
-          MOKOGITEA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          ARGS="--token ${MOKOGITEA_TOKEN}"
-          ARGS="${ARGS} --org ${{ vars.GITEA_ORG || github.repository_owner }}"
-          ARGS="${ARGS} --phase repos"
-
-          PLATFORM="${{ steps.platform.outputs.platform }}"
-          if [ -n "$PLATFORM" ]; then
-            ARGS="${ARGS} --platform-filter ${PLATFORM}"
-          fi
-
-          php /tmp/mokocli/cli/workflow_sync.php ${ARGS}

CHANGELOG.md

@@ -1,30 +1,4 @@
-<!--	Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 
-	This file is part of a Moko Consulting project.
-
-	SPDX-LICENSE-IDENTIFIER: GPL-3.0-or-later
-
-	This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.
-
-	This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the IMPLIED WARRANTY of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
-
-	You should have received a copy of the GNU General Public License (./LICENSE).
-
-	# FILE INFORMATION
-	DEFGROUP: dolibarr-api-mcp.Documentation
-	INGROUP: dolibarr-api-mcp
-	REPO: https://git.mokoconsulting.tech/MokoConsulting/dolibarr-api-mcp
-	VERSION: 01.00.00
-	PATH: ./CHANGELOG.md
-	BRIEF: Version history and change log
--->
-
-# Changelog
-
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
@@ -35,36 +9,3 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 - `branch-cleanup.yml`: auto-delete merged feature branches after PR merge
-
-## [0.0.1] - 2026-05-07
-
-### Added
-- Initial MCP server with Dolibarr REST API tools
-- Third party management (list, get, create, update, delete)
-- Invoice management (list, get, create, add lines, validate, set paid)
-- Commercial proposal management (list, get, create, add lines, validate, close)
-- Customer order management (list, get, create, validate)
-- Product and service catalog (list, get, create, update, stock levels)
-- Contact/address management (list, get)
-- Project management (list, get, create)
-- Task management (list, get)
-- User management (list, get)
-- Category management (list by type)
-- Bank account listing
-- Supplier invoice listing
-- Supplier order listing
-- Warehouse listing
-- Company setup and system status endpoints
-- Raw API passthrough for any Dolibarr endpoint
-- Multi-connection support with named connections
-- Interactive setup wizard (`npm run setup`)
-- SQL filter builder (`buildSqlFilter`, `searchFilter`) for safe query construction
-- Full documentation: README, INSTALLATION, ARCHITECTURE, API reference
-- MokoStandards-compliant project structure
-- 12 MokoGitea Actions CI/CD workflows
-
-## Revision History
-
-| Date | Version | Author | Notes |
-| --- | --- | --- | --- |
-| 2026-05-07 | 0.0.1 | jmiller | Initial release |

CLAUDE.md

@@ -13,7 +13,7 @@ This file provides guidance to Claude Code when working with this repository.
 | **Default branch** | main |
 | **License** | GPL-3.0-or-later |
 | **Wiki** | [dolibarr-api-mcp Wiki](https://git.mokoconsulting.tech/MokoConsulting/dolibarr-api-mcp/wiki) |
-| **Standards** | [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki) |
+| **Standards** | [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/moko-platform/wiki/Home) |
 
 ## Common Commands
 
@@ -33,11 +33,9 @@ This is an MCP (Model Context Protocol) server. Key files:
 
 ## Rules
 
-- **Workflow directory**: `.mokogitea/` (not `.gitea/` or `.github/`)
-
 - **Never commit** `.claude/`, `.mcp.json`, `TODO.md`, or `*.min.css`/`*.min.js`
 - **Attribution**: use `Authored-by: Moko Consulting` in commits
 - **Branch strategy**: develop on `dev`, merge to `main` for release
 - **Minification**: handled at build time (CI) and runtime (MokoMinifyHelper for Joomla templates)
-- **Wiki**: documentation lives in the MokoGitea wiki, not in `docs/` files
+- **Wiki**: documentation lives in the Gitea wiki, not in `docs/` files
-- **Standards**: this repo follows [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/.mokogitea/wiki)
+- **Standards**: this repo follows [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/moko-platform/wiki/Home)

CONTRIBUTING.md

@@ -1,161 +1,161 @@
-# Contributing to Moko Consulting Projects
+<!--	Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-
+
-Thank you for your interest in contributing. All Moko Consulting repositories follow this universal workflow and version policy.
+	This file is part of a Moko Consulting project.
-
+
-## Branching Workflow
+	SPDX-LICENSE-IDENTIFIER: GPL-3.0-or-later
-
+
-```
+	This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 3 of the License, or (at your option) any later version.
-feature/* ──PR──> dev ──draft PR──> (renamed to rc) ──merge──> main
+
-```
+	This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the IMPLIED WARRANTY of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
-
+
-### Step by step
+	You should have received a copy of the GNU General Public License (./LICENSE).
-
+
-1. **Create a feature branch** from `dev`:
+	# FILE INFORMATION
-   ```bash
+	DEFGROUP: dolibarr-api-mcp.Documentation
-   git checkout dev && git pull
+	INGROUP: dolibarr-api-mcp
-   git checkout -b feature/my-change
+	REPO: https://git.mokoconsulting.tech/MokoConsulting/dolibarr-api-mcp
-   ```
+	VERSION: 01.00.00
-
+	PATH: ./CONTRIBUTING.md
-2. **Work and commit** on your feature branch. Push to origin.
+	BRIEF: Contribution guidelines for the project
-
+-->
-3. **Open a PR**: `feature/my-change` → `dev`. After review and checks, merge it.
+
-
+# Contributing to dolibarr-api-mcp
-4. **When ready for release**, open a **draft PR**: `dev` → `main`.
+
-   - This automatically renames the source branch to `rc` (release candidate)
+We appreciate your interest in contributing to this project! This document provides guidelines for contributing.
-   - An RC pre-release is built and uploaded
+
-
+## Table of Contents
-5. **Alpha and beta branches** are created by manually renaming the branch before the RC stage:
+
-   - Rename `dev` to `alpha` for early testing → alpha pre-release is built
+- [Code of Conduct](#code-of-conduct)
-   - Rename `alpha` to `beta` for feature-complete testing → beta pre-release is built
+- [Getting Started](#getting-started)
-   - When the draft PR is created, the branch is renamed to `rc`
+- [How to Contribute](#how-to-contribute)
-
+- [Development Workflow](#development-workflow)
-6. **Once PR checks pass** on the `rc` branch, mark the PR as ready and merge to `main`.
+- [Commit Messages](#commit-messages)
-
+- [Pull Request Process](#pull-request-process)
-7. **Merging to main** triggers the stable release pipeline:
+
-   - Minor version bump (e.g., `02.09.xx` → `02.10.00`)
+## Code of Conduct
-   - Stability suffix stripped (clean version)
+
-   - MokoGitea release created with ZIP/tar.gz packages
+This project adheres to the Contributor Covenant Code of Conduct. By participating, you are expected to uphold this code. Please report unacceptable behavior to hello@mokoconsulting.tech.
-   - `updates.xml` updated (Joomla extensions)
+
-   - `dev` branch recreated from `main`
+## Getting Started
-
+
-### Branch summary
+1. Fork the repository
-
+2. Clone your fork locally
-| Branch | Purpose | Created by |
+3. Install dependencies: `npm install`
-|--------|---------|-----------|
+4. Build: `npm run build`
-| `feature/*` | New features and fixes | Developer |
+5. Create a new branch for your work
-| `dev` | Integration branch | Auto-recreated after release |
+
-| `alpha` | Alpha pre-release testing | Manual rename from `dev` |
+## How to Contribute
-| `beta` | Beta pre-release testing | Manual rename from `alpha` |
+
-| `rc` | Release candidate | Auto-renamed on draft PR to main |
+### Reporting Bugs
-| `main` | Stable releases | Protected, merge only |
+
-| `version/XX.YY.ZZ` | Archived release snapshots | Auto-created by CI |
+- Use the Gitea issue tracker
-
+- Describe the bug clearly with steps to reproduce
-### Protected branches
+- Include the Dolibarr version you're connecting to
-
+- Include relevant logs or error messages
-| Branch | Direct push | Merge via |
+
-|--------|------------|-----------|
+### Adding New Tools
-| `main` | Blocked (CI bot whitelisted) | PR merge only |
+
-| `dev` | Blocked (CI bot whitelisted) | PR merge from feature/* |
+If you want to add support for a Dolibarr API endpoint not yet covered:
-| `rc` | Blocked (CI bot whitelisted) | Auto-created on draft PR |
+
-| `alpha` | Blocked (CI bot whitelisted) | Manual rename |
+1. Check the [Dolibarr API Explorer](https://your-dolibarr.com/api/index.php/explorer) for endpoint details
-| `beta` | Blocked (CI bot whitelisted) | Manual rename |
+2. Add the tool registration in `src/index.ts` following the existing patterns
-| `feature/*` | Open | N/A (source branch) |
+3. Update `docs/API.md` with the new tool's parameter table
-
+4. Update `README.md` tool listing
-## Version Policy
+5. Update `CHANGELOG.md`
-
+
-### Format
+### Contributing Code
-
+
-All versions use `XX.YY.ZZ` — three two-digit segments, zero-padded:
+- Pick an issue or create one
-
+- Fork the repository and create a branch
-- **XX** — Major version (breaking changes)
+- Make your changes following the project conventions
-- **YY** — Minor version (new features, bumped on release to main)
+- Submit a pull request
-- **ZZ** — Patch version (auto-incremented on every push to dev/feature branches)
+
-
+## Development Workflow
-Rollover: patch `99` → `00` increments minor; minor `99` → `00` increments major.
+
-
+1. Ensure your fork is up to date with the main repository
-### Stability suffixes
+2. Create a feature branch from `main`
-
+3. Make your changes
-Each branch appends a suffix to indicate stability:
+4. Test against a Dolibarr instance (use `npm run setup` to configure a dev connection)
-
+5. Build with `npm run build` to catch TypeScript errors
-| Branch | Suffix | Example |
+6. Commit your changes with clear messages
-|--------|--------|---------|
+7. Push to your fork
-| `main` | (none) | `02.09.00` |
+8. Create a pull request
-| `dev` | `-dev` | `02.09.01-dev` |
+
-| `feature/*` | `-dev` | `02.09.01-dev` |
+## Commit Messages
-| `alpha` | `-alpha` | `02.09.01-alpha` |
+
-| `beta` | `-beta` | `02.09.01-beta` |
+Follow the conventional commit format:
-| `rc` | `-rc` | `02.09.01-rc` |
+
-
+```
-### Auto version bump
+<type>(<scope>): <subject>
-
+
-On every push to `dev`, `feature/*`, or `patch/*`:
+<body>
-
+
-1. Patch version incremented
+<footer>
-2. Stability suffix `-dev` applied
+```
-3. All version-bearing files updated (manifests, CHANGELOG, PHP headers, etc.)
+
-4. Commit created with `[skip ci]` to avoid loops
+Types: `feat`, `fix`, `docs`, `style`, `refactor`, `test`, `chore`, `ci`, `build`, `perf`, `revert`
-
+
-### Release version flow
+Example:
-
+```
-Version bumps happen at specific release events:
+feat(tools): add shipment management tools
-
+
-| Event | Bump | Example |
+Add dolibarr_shipments_list, dolibarr_shipment_get, and
-|-------|------|---------|
+dolibarr_shipment_validate tools for the /shipments API endpoint.
-| Feature merged to dev | Patch bump after dev release | `02.09.01-dev` → release → `02.09.02-dev` |
+```
-| Dev promoted to RC | Minor bump | `02.09.02-dev` → `02.10.00-rc` |
+
-| RC merged to main | Minor bump | `02.10.00-rc` → `02.11.00` (stable) |
+## Pull Request Process
-| Dev recreated from main | Patch bump | `02.11.00` → `02.11.01-dev` |
+
-
+1. Update documentation for any new tools
-### Release stream copies
+2. Follow the project's coding style and conventions
-
+3. Ensure `npm run build` succeeds without errors
-When a higher-stability release is published, copies are created for all lesser streams with the same base version:
+4. Update the CHANGELOG.md with your changes
-
+5. Request review from maintainers
-- **RC `02.10.00-rc`** also creates: `02.10.00-dev`, `02.10.00-alpha`, `02.10.00-beta`
+6. Address any feedback promptly
-- **Stable `02.11.00`** also creates: `02.11.00-dev`, `02.11.00-alpha`, `02.11.00-beta`, `02.11.00-rc`
+7. Once approved, your PR will be merged
-
+
-This ensures Joomla sites on ANY stability channel see the update (Joomla only shows versions higher than what's installed).
+## Style Guidelines
-
+
-### Version files
+- Use tabs for indentation
-
+- All source files must include the Moko Consulting copyright header
-The version tools update all files containing version stamps:
+- Use `snake_case` for local variables (matching Dolibarr API field names)
-
+- Use Zod for all tool parameter validation
-- `.mokogitea/manifest.xml` (canonical source)
+- Follow the `formatResponse()` pattern for consistent error handling
-- Joomla XML manifests (`<version>` tag)
+
-- `README.md`, `CHANGELOG.md` (`VERSION:` pattern)
+## Infrastructure Standards
-- `package.json`, `pyproject.toml`
+
-- Any text file with a `VERSION: XX.YY.ZZ` label
+All repositories in the MokoConsulting org follow these conventions:
-
+
-Files synced from other repos (with a `# REPO:` header) are not touched.
+### Release Tags
-
+
-## Code Standards
+Every repo maintains 5 standard release channel tags:
-
+
-- **PHP**: PSR-12, tabs for indentation
+- `development` - Active development builds
-- **Copyright**: all files must include the Moko Consulting copyright header
+- `alpha` - Early internal testing
-- **License**: SPDX identifier `GPL-3.0-or-later` (or as specified per repo)
+- `beta` - Broader testing / client UAT
-- **Attribution**: use `Authored-by: Moko Consulting` in commits, not individual names
+- `release-candidate` - Final QA before production
-
+- `stable` - Production release
-## Commit Messages
+
-
+### Branch Protection
-Use conventional commit format:
+
-
+- `main` is protected; only `jmiller` can push directly
-```
+- All other contributors must use pull requests
-type(scope): short description
+- PRs are automatically reviewed by Claude Code
-
+
-Optional body with context.
+### CI/CD
-
+
-Authored-by: Moko Consulting
+- Gitea Actions runs all CI workflows
-```
+- Workflows live in `.gitea/workflows/`
-
+
-Types: `feat`, `fix`, `chore`, `docs`, `style`, `refactor`, `test`, `ci`
+### Secrets
-
+
-Special flags in commit messages:
+All repos have `GA_TOKEN` and `GH_TOKEN` as Actions secrets for API access.
-- `[skip ci]` — skip all CI workflows
+
-- `[skip bump]` — skip auto version bump only
+## Questions?
-
+
-## Reporting Issues
+If you have questions about contributing, feel free to open an issue or contact the maintainers at hello@mokoconsulting.tech.
-
+
-Use the repository's issue tracker with the appropriate template.
+## Revision History
-
+
----
+| Date | Version | Author | Notes |
-
+| --- | --- | --- | --- |
-*Moko Consulting <hello@mokoconsulting.tech>*
+| 2026-05-07 | 0.0.1 | jmiller | Initial contributing guidelines |

README.md

@@ -8,7 +8,7 @@ MCP server for Dolibarr ERP/CRM REST API operations
 |---|---|
 | **Language** | TypeScript |
 | **License** | GPL-3.0-or-later |
-| **Platform** | [MokoGitea](https://git.mokoconsulting.tech/MokoConsulting/dolibarr-api-mcp) |
+| **Platform** | [Gitea](https://git.mokoconsulting.tech/MokoConsulting/dolibarr-api-mcp) |
 | **Node.js** | >= 20.0.0 |
 | **MCP SDK** | @modelcontextprotocol/sdk ^1.12.1 |
 
@@ -367,4 +367,4 @@ This project is licensed under the GNU General Public License v3.0 or later -- s
 
 ---
 
-*[Moko Consulting](https://mokoconsulting.tech) -- [MokoCLI](https://git.mokoconsulting.tech/MokoConsulting/mokocli)*
+*[Moko Consulting](https://mokoconsulting.tech) -- [MokoStandards](https://git.mokoconsulting.tech/MokoConsulting/moko-platform/wiki/Home)*

SECURITY.md

@@ -31,7 +31,7 @@ Only the current major version receives security updates.
 
 ## Reporting a Vulnerability
 
-Report security vulnerabilities via MokoGitea issue (preferred):
+Report security vulnerabilities via Gitea issue (preferred):
 https://git.mokoconsulting.tech/MokoConsulting/dolibarr-api-mcp/issues/new?template=security.yaml
 
 Or email: hello@mokoconsulting.tech

automation/ci-issue-reporter.sh

@@ -0,0 +1,237 @@
+#!/usr/bin/env bash
+# ============================================================================
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: Automation.CI
+# INGROUP: moko-platform.Automation
+# REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
+# PATH: /automation/ci-issue-reporter.sh
+# VERSION: 09.23.00
+# BRIEF: Creates or updates a Gitea issue when a CI gate fails.
+#        Deduplicates by searching open issues with the "ci-auto" label
+#        whose title matches the gate. If a matching issue exists, a comment
+#        is appended instead of opening a duplicate.
+# ============================================================================
+
+set -euo pipefail
+
+# ── Defaults ────────────────────────────────────────────────────────────────
+GITEA_URL="${GITEA_URL:-https://git.mokoconsulting.tech}"
+GITEA_TOKEN="${GITEA_TOKEN:-}"
+REPO="${GITHUB_REPOSITORY:-}"
+RUN_URL="${GITHUB_SERVER_URL:-${GITEA_URL}}/${REPO}/actions/runs/${GITHUB_RUN_ID:-0}"
+LABEL_NAME="ci-auto"
+LABEL_COLOR="#e11d48"
+
+GATE=""
+DETAILS=""
+SEVERITY="error"
+WORKFLOW=""
+
+# ── Parse arguments ─────────────────────────────────────────────────────────
+usage() {
+  cat <<EOF
+Usage: ci-issue-reporter.sh --gate NAME --details TEXT [OPTIONS]
+
+Required:
+  --gate      CI gate name (e.g. "Code Quality", "Self-Health")
+  --details   Human-readable failure description
+
+Optional:
+  --severity  "error" (default) or "warning"
+  --workflow  Workflow name for the issue title
+  --repo      owner/repo (default: \$GITHUB_REPOSITORY)
+  --run-url   URL to the CI run (auto-detected from env)
+  --token     Gitea API token (default: \$GITEA_TOKEN)
+  --url       Gitea base URL (default: \$GITEA_URL)
+EOF
+  exit 1
+}
+
+while [[ $# -gt 0 ]]; do
+  case "$1" in
+    --gate)     GATE="$2";       shift 2 ;;
+    --details)  DETAILS="$2";    shift 2 ;;
+    --severity) SEVERITY="$2";   shift 2 ;;
+    --workflow) WORKFLOW="$2";   shift 2 ;;
+    --repo)     REPO="$2";      shift 2 ;;
+    --run-url)  RUN_URL="$2";   shift 2 ;;
+    --token)    GITEA_TOKEN="$2"; shift 2 ;;
+    --url)      GITEA_URL="$2"; shift 2 ;;
+    -h|--help)  usage ;;
+    *)          echo "Unknown option: $1"; usage ;;
+  esac
+done
+
+[[ -z "$GATE" ]]         && { echo "ERROR: --gate is required"; usage; }
+[[ -z "$DETAILS" ]]      && { echo "ERROR: --details is required"; usage; }
+[[ -z "$GITEA_TOKEN" ]]  && { echo "ERROR: GITEA_TOKEN not set"; exit 1; }
+[[ -z "$REPO" ]]         && { echo "ERROR: GITHUB_REPOSITORY not set"; exit 1; }
+
+API="${GITEA_URL}/api/v1/repos/${REPO}"
+
+# ── Build title ─────────────────────────────────────────────────────────────
+if [[ -n "$WORKFLOW" ]]; then
+  TITLE="[CI] ${WORKFLOW}: ${GATE} failed"
+else
+  TITLE="[CI] ${GATE} failed"
+fi
+
+# ── Ensure label exists ─────────────────────────────────────────────────────
+ensure_label() {
+  local exists
+  exists=$(curl -sf -o /dev/null -w '%{http_code}' \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    "${API}/labels" 2>/dev/null || echo "000")
+
+  if [[ "$exists" == "200" ]]; then
+    # Check if label already exists
+    local found
+    found=$(curl -sf \
+      -H "Authorization: token ${GITEA_TOKEN}" \
+      "${API}/labels" 2>/dev/null \
+      | grep -o "\"name\":\"${LABEL_NAME}\"" || true)
+
+    if [[ -z "$found" ]]; then
+      curl -sf -X POST \
+        -H "Authorization: token ${GITEA_TOKEN}" \
+        -H "Content-Type: application/json" \
+        "${API}/labels" \
+        -d "{\"name\":\"${LABEL_NAME}\",\"color\":\"${LABEL_COLOR}\",\"description\":\"Auto-created by CI issue reporter\"}" \
+        > /dev/null 2>&1 || true
+    fi
+  fi
+}
+
+# ── Search for existing open issue ──────────────────────────────────────────
+find_existing_issue() {
+  # URL-encode the gate name for the query
+  local query
+  query=$(printf '%s' "[CI] ${GATE}" | sed 's/ /%20/g; s/\[/%5B/g; s/\]/%5D/g')
+
+  local response
+  response=$(curl -sf \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    "${API}/issues?type=issues&state=open&labels=${LABEL_NAME}&q=${query}&limit=5" \
+    2>/dev/null || echo "[]")
+
+  # Extract the first matching issue number
+  echo "$response" \
+    | grep -oP '"number":\s*\K[0-9]+' \
+    | head -1
+}
+
+# ── Build issue body ────────────────────────────────────────────────────────
+build_body() {
+  local severity_badge
+  if [[ "$SEVERITY" == "error" ]]; then
+    severity_badge="**Severity:** Error"
+  else
+    severity_badge="**Severity:** Warning"
+  fi
+
+  cat <<BODY
+## CI Gate Failure: ${GATE}
+
+${severity_badge}
+**Workflow:** ${WORKFLOW:-unknown}
+**Branch:** ${GITHUB_REF_NAME:-unknown}
+**Commit:** \`${GITHUB_SHA:0:8}\`
+**Run:** [View CI run](${RUN_URL})
+
+### Details
+
+${DETAILS}
+
+### Resolution
+
+Fix the issue described above and push a new commit. This issue will be closed automatically when the gate passes, or can be closed manually.
+
+---
+*Auto-created by [ci-issue-reporter](${GITEA_URL}/${REPO}/src/branch/main/automation/ci-issue-reporter.sh)*
+BODY
+}
+
+# ── Build comment body (for existing issues) ────────────────────────────────
+build_comment() {
+  cat <<COMMENT
+### CI failure recurrence
+
+**Branch:** ${GITHUB_REF_NAME:-unknown}
+**Commit:** \`${GITHUB_SHA:0:8}\`
+**Run:** [View CI run](${RUN_URL})
+
+${DETAILS}
+COMMENT
+}
+
+# ── Main ────────────────────────────────────────────────────────────────────
+ensure_label
+
+EXISTING=$(find_existing_issue)
+
+if [[ -n "$EXISTING" ]]; then
+  # Append comment to existing issue
+  COMMENT_BODY=$(build_comment)
+  COMMENT_JSON=$(printf '%s' "$COMMENT_BODY" | python3 -c "
+import sys, json
+print(json.dumps({'body': sys.stdin.read()}))" 2>/dev/null)
+
+  HTTP=$(curl -sf -o /dev/null -w '%{http_code}' -X POST \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    -H "Content-Type: application/json" \
+    "${API}/issues/${EXISTING}/comments" \
+    -d "${COMMENT_JSON}" 2>/dev/null || echo "000")
+
+  if [[ "$HTTP" == "201" ]]; then
+    echo "Commented on existing issue #${EXISTING}"
+  else
+    echo "WARNING: Failed to comment on issue #${EXISTING} (HTTP ${HTTP})"
+  fi
+else
+  # Create new issue
+  ISSUE_BODY=$(build_body)
+  ISSUE_JSON=$(python3 -c "
+import sys, json
+body = sys.stdin.read()
+print(json.dumps({
+    'title': sys.argv[1],
+    'body': body,
+    'labels': []
+}))" "$TITLE" <<< "$ISSUE_BODY" 2>/dev/null)
+
+  # Create the issue
+  RESPONSE=$(curl -sf -X POST \
+    -H "Authorization: token ${GITEA_TOKEN}" \
+    -H "Content-Type: application/json" \
+    "${API}/issues" \
+    -d "${ISSUE_JSON}" 2>/dev/null || echo "{}")
+
+  ISSUE_NUM=$(echo "$RESPONSE" | grep -oP '"number":\s*\K[0-9]+' | head -1)
+
+  if [[ -n "$ISSUE_NUM" ]]; then
+    # Apply label (separate call — more reliable across Gitea versions)
+    LABEL_ID=$(curl -sf \
+      -H "Authorization: token ${GITEA_TOKEN}" \
+      "${API}/labels" 2>/dev/null \
+      | grep -oP "\"id\":\s*\K[0-9]+(?=[^}]*\"name\":\s*\"${LABEL_NAME}\")" \
+      | head -1 || true)
+
+    if [[ -n "$LABEL_ID" ]]; then
+      curl -sf -X POST \
+        -H "Authorization: token ${GITEA_TOKEN}" \
+        -H "Content-Type: application/json" \
+        "${API}/issues/${ISSUE_NUM}/labels" \
+        -d "{\"labels\":[${LABEL_ID}]}" \
+        > /dev/null 2>&1 || true
+    fi
+
+    echo "Created issue #${ISSUE_NUM}: ${TITLE}"
+  else
+    echo "WARNING: Failed to create issue"
+    echo "Response: ${RESPONSE}"
+  fi
+fi

package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@mokoconsulting/mcp-mokocrm-api",
-	"version": "1.0.4",
+	"version": "1.0.0",
 	"description": "MCP server for Dolibarr ERP/CRM REST API operations",
 	"type": "module",
 	"main": "dist/index.js",
@@ -30,6 +30,6 @@
 	"author": "Moko Consulting <hello@mokoconsulting.tech>",
 	"repository": {
 		"type": "git",
-		"url": "https://git.mokoconsulting.tech/MokoConsulting/mcp-mokocrm-api.git"
+		"url": "https://git.mokoconsulting.tech/MokoConsulting/dolibarr-api-mcp.git"
 	}
 }

scripts/setup.mjs

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+/* Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+ *
+ * This file is part of a Moko Consulting project.
+ *
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *
+ * FILE INFORMATION
+ * DEFGROUP: dolibarr-api-mcp.Scripts
+ * INGROUP: dolibarr-api-mcp
+ * REPO: https://git.mokoconsulting.tech/MokoConsulting/dolibarr-api-mcp
+ * PATH: /scripts/setup.mjs
+ * VERSION: 01.00.00
+ * BRIEF: Interactive setup — prompts for Dolibarr API connection details and writes config
+ */
+
+import { createInterface } from 'node:readline/promises';
+import { readFile, writeFile } from 'node:fs/promises';
+import { resolve } from 'node:path';
+import { homedir } from 'node:os';
+
+const CONFIG_PATH = resolve(homedir(), '.dolibarr-api-mcp.json');
+
+const rl = createInterface({ input: process.stdin, output: process.stdout });
+
+async function prompt(question, defaultValue) {
+	const suffix = defaultValue ? ` [${defaultValue}]` : '';
+	const answer = await rl.question(`${question}${suffix}: `);
+	return answer.trim() || defaultValue || '';
+}
+
+async function promptRequired(question) {
+	let answer = '';
+	while (!answer) {
+		answer = (await rl.question(`${question}: `)).trim();
+		if (!answer) {
+			console.log('  This field is required.');
+		}
+	}
+	return answer;
+}
+
+async function main() {
+	console.log('');
+	console.log('=== dolibarr-api-mcp Setup ===');
+	console.log('');
+	console.log('This will create your configuration file at:');
+	console.log(`  ${CONFIG_PATH}`);
+	console.log('');
+
+	// Check for existing config
+	let existing = null;
+	try {
+		const raw = await readFile(CONFIG_PATH, 'utf-8');
+		existing = JSON.parse(raw);
+		console.log('Existing config found. You can add a new connection or overwrite.');
+		console.log(`  Current connections: ${Object.keys(existing.connections).join(', ')}`);
+		console.log('');
+	} catch {
+		// No existing config
+	}
+
+	const connectionName = await prompt('Connection name', 'production');
+	const baseUrl = await promptRequired('Dolibarr URL (e.g. https://erp.example.com)');
+	const apiKey = await promptRequired('Dolibarr API key (from user settings or Setup > Security)');
+
+	const cleanUrl = baseUrl.replace(/\/+$/, '');
+
+	const insecureAnswer = await prompt('Skip TLS verification for self-signed certs? (y/N)', 'N');
+	const insecure = insecureAnswer.toLowerCase() === 'y';
+
+	const connection = { baseUrl: cleanUrl, apiKey };
+	if (insecure) {
+		connection.insecure = true;
+	}
+
+	let config;
+	if (existing) {
+		config = existing;
+		config.connections[connectionName] = connection;
+		const setDefault = await prompt(`Set "${connectionName}" as default connection? (y/N)`, 'N');
+		if (setDefault.toLowerCase() === 'y') {
+			config.defaultConnection = connectionName;
+		}
+	} else {
+		config = {
+			defaultConnection: connectionName,
+			connections: {
+				[connectionName]: connection,
+			},
+		};
+	}
+
+	await writeFile(CONFIG_PATH, JSON.stringify(config, null, '\t') + '\n', 'utf-8');
+
+	console.log('');
+	console.log(`Config written to ${CONFIG_PATH}`);
+	console.log(`  Connection "${connectionName}" configured for ${cleanUrl}`);
+	console.log('');
+
+	const addAnother = await prompt('Add another connection? (y/N)', 'N');
+	if (addAnother.toLowerCase() === 'y') {
+		rl.close();
+		// Re-run to add another
+		const { execFileSync } = await import('node:child_process');
+		execFileSync('node', [new URL(import.meta.url).pathname], { stdio: 'inherit' });
+		return;
+	}
+
+	console.log('Setup complete. You can now use the MCP server.');
+	console.log('');
+	rl.close();
+}
+
+main().catch((err) => {
+	console.error(`Setup failed: ${err.message}`);
+	rl.close();
+	process.exit(1);
+});