fix: update all workflows to latest MokoStandards v04.04 templates [skip ci]

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/CODEOWNERS

@@ -1,37 +1,36 @@
-# CODEOWNERS
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# CODEOWNERS — require approval from jmiller-moko for protected paths
+# Synced from MokoStandards. Do not edit manually.
+#
+# Changes to these paths require review from the listed owners before merge.
+# Combined with branch protection (require PR reviews), this prevents
+# unauthorized modifications to workflows, configs, and governance files.
 
-## Repository Ownership Matrix
+# ── Workflows (synced from MokoStandards — must not be manually edited) ──
+/.github/workflows/                     @jmiller-moko
 
-```
+# ── GitHub configuration ─────────────────────────────────────────────────
-# GLOBAL DEFAULT
+/.github/ISSUE_TEMPLATE/                @jmiller-moko
-* @mokoconsulting-tech/maintainers
+/.github/CODEOWNERS                     @jmiller-moko
+/.github/copilot.yml                    @jmiller-moko
+/.github/copilot-instructions.md        @jmiller-moko
+/.github/CLAUDE.md                      @jmiller-moko
+/.github/.mokostandards                 @jmiller-moko
 
-# DOCUMENTATION SUITE
+# ── Build and config files ───────────────────────────────────────────────
-/docs/ @mokoconsulting-tech/documentation
+/composer.json                          @jmiller-moko
-/docs/templates/ @mokoconsulting-tech/documentation
+/phpstan.neon                           @jmiller-moko
-/docs/adr/ @mokoconsulting-tech/architecture
+/Makefile                               @jmiller-moko
-/docs/diagrams/ @mokoconsulting-tech/architecture
+/.ftp_ignore                            @jmiller-moko
-/docs/security/ @mokoconsulting-tech/security
+/.gitignore                             @jmiller-moko
+/.gitattributes                         @jmiller-moko
+/.editorconfig                          @jmiller-moko
 
-# ENGINEERING + CODE ASSETS
+# ── Governance documents ─────────────────────────────────────────────────
-/htdocs/ @mokoconsulting-tech/engineering
+/LICENSE                                @jmiller-moko
-/src/ @mokoconsulting-tech/engineering
+/CONTRIBUTING.md                        @jmiller-moko
-/api/ @mokoconsulting-tech/engineering
+/SECURITY.md                            @jmiller-moko
-
+/GOVERNANCE.md                          @jmiller-moko
-# CI/CD WORKFLOWS
+/CODE_OF_CONDUCT.md                     @jmiller-moko
-/.github/workflows/ @mokoconsulting-tech/devops
-
-# ISSUE TEMPLATES
-/.github/ISSUE_TEMPLATE/ @mokoconsulting-tech/documentation
-
-# GOVERNANCE + OPERATIONAL FILES
-/CONTRIBUTING.md @mokoconsulting-tech/governance
-/GOVERNANCE.md @mokoconsulting-tech/governance
-/CODE_OF_CONDUCT.md @mokoconsulting-tech/governance
-
-# SECURITY
-/SECURITY.md @mokoconsulting-tech/security
-
-# TEMPLATE LIBRARY
-/docs/templates/ @mokoconsulting-tech/documentation
-```

.github/workflows/auto-dev-issue.yml

@@ -0,0 +1,102 @@
+# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
+#
+# This file is part of a Moko Consulting project.
+#
+# SPDX-License-Identifier: GPL-3.0-or-later
+#
+# FILE INFORMATION
+# DEFGROUP: GitHub.Workflow
+# INGROUP: MokoStandards.Automation
+# REPO: https://github.com/mokoconsulting-tech/MokoStandards
+# PATH: /templates/workflows/shared/auto-dev-issue.yml.template
+# VERSION: 04.04.01
+# BRIEF: Auto-create tracking issue when a dev/** or rc/** branch is pushed
+# NOTE: Synced via bulk-repo-sync to .github/workflows/auto-dev-issue.yml in all governed repos.
+
+name: Auto Dev Branch Issue
+
+on:
+  create:
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+permissions:
+  contents: read
+  issues: write
+
+jobs:
+  create-issue:
+    name: Create version tracking issue
+    runs-on: ubuntu-latest
+    if: >-
+      github.event.ref_type == 'branch' &&
+      (startsWith(github.event.ref, 'dev/') || startsWith(github.event.ref, 'rc/'))
+
+    steps:
+      - name: Create tracking issue
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
+        run: |
+          BRANCH="${{ github.event.ref }}"
+          REPO="${{ github.repository }}"
+          ACTOR="${{ github.actor }}"
+          NOW=$(date -u '+%Y-%m-%d %H:%M UTC')
+
+          # Determine branch type and version
+          if [[ "$BRANCH" == rc/* ]]; then
+            VERSION="${BRANCH#rc/}"
+            BRANCH_TYPE="Release Candidate"
+            LABEL_TYPE="type: release"
+            TITLE_PREFIX="rc"
+          else
+            VERSION="${BRANCH#dev/}"
+            BRANCH_TYPE="Development"
+            LABEL_TYPE="type: feature"
+            TITLE_PREFIX="feat"
+          fi
+
+          TITLE="${TITLE_PREFIX}(${VERSION}): ${BRANCH_TYPE} tracking for ${BRANCH}"
+
+          BODY="## ${BRANCH_TYPE} Branch Created
+
+          | Field | Value |
+          |-------|-------|
+          | **Branch** | \`${BRANCH}\` |
+          | **Version** | \`${VERSION}\` |
+          | **Type** | ${BRANCH_TYPE} |
+          | **Created by** | @${ACTOR} |
+          | **Created at** | ${NOW} |
+          | **Repository** | \`${REPO}\` |
+
+          ## Checklist
+
+          - [ ] Feature development complete
+          - [ ] Tests passing
+          - [ ] README.md version bumped to \`${VERSION}\`
+          - [ ] CHANGELOG.md updated
+          - [ ] PR created targeting \`main\`
+          - [ ] Code reviewed and approved
+          - [ ] Merged to \`main\`
+
+          ---
+          *Auto-created by [auto-dev-issue.yml](.github/workflows/auto-dev-issue.yml) on branch creation.*"
+
+          # Dedent heredoc
+          BODY=$(echo "$BODY" | sed 's/^          //')
+
+          # Check for existing issue with same title prefix
+          EXISTING=$(gh api "repos/${REPO}/issues?state=open&per_page=5" \
+            --jq ".[] | select(.title | startswith(\"${TITLE_PREFIX}(${VERSION})\")) | .number" 2>/dev/null | head -1)
+
+          if [ -n "$EXISTING" ]; then
+            echo "ℹ️ Issue #${EXISTING} already exists for ${VERSION}" >> $GITHUB_STEP_SUMMARY
+          else
+            ISSUE_URL=$(gh issue create \
+              --repo "$REPO" \
+              --title "$TITLE" \
+              --body "$BODY" \
+              --label "${LABEL_TYPE},version" \
+              --assignee "jmiller-moko" 2>&1)
+            echo "✅ Created tracking issue: ${ISSUE_URL}" >> $GITHUB_STEP_SUMMARY
+          fi

.github/workflows/auto-release.yml

@@ -1,20 +1,36 @@
 # Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
 #
-# This file is part of a Moko Consulting project.
-#
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
 # DEFGROUP: GitHub.Workflow
 # INGROUP: MokoStandards.Release
 # REPO: https://github.com/mokoconsulting-tech/MokoStandards
-# PATH: /templates/workflows/shared/auto-release.yml
+# PATH: /templates/workflows/shared/auto-release.yml.template
-# VERSION: 04.01.00
+# VERSION: 04.04.01
-# BRIEF: Auto-create a GitHub Release on every push to main with version from README.md
+# BRIEF: Unified build & release pipeline — version branch, platform version, badges, tag, release
-# NOTE: Synced via bulk-repo-sync to .github/workflows/auto-release.yml in all governed repos.
+#
-#       For Dolibarr (crm-module) repos, also updates $this->version in the module descriptor.
+# ╔════════════════════════════════════════════════════════════════════════╗
+# ║                    BUILD & RELEASE PIPELINE                            ║
+# ╠════════════════════════════════════════════════════════════════════════╣
+# ║                                                                        ║
+# ║  Triggers on push to main (skips bot commits + [skip ci]):             ║
+# ║                                                                        ║
+# ║  Every push:                                                           ║
+# ║    1. Read version from README.md                                      ║
+# ║    3. Set platform version (Dolibarr $this->version, Joomla <version>)║
+# ║    4. Update [VERSION: XX.YY.ZZ] badges in markdown files             ║
+# ║    5. Write update.txt / update.xml                                    ║
+# ║    6. Create git tag vXX.YY.ZZ                                        ║
+# ║    7a. Patch: update existing GitHub Release for this minor            ║
+# ║                                                                        ║
+# ║  Minor releases only (patch == 00):                                    ║
+# ║    2. Create/update version/XX.YY branch (patches update in-place)    ║
+# ║    7b. Create new GitHub Release                                       ║
+# ║                                                                        ║
+# ╚════════════════════════════════════════════════════════════════════════╝
 
-name: Auto Release
+name: Build & Release
 
 on:
   push:
@@ -22,14 +38,16 @@ on:
       - main
       - master
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 permissions:
   contents: write
 
 jobs:
   release:
-    name: Create Release
+    name: Build & Release Pipeline
     runs-on: ubuntu-latest
-    # Skip bot commits (version sync, [skip ci]) to avoid infinite loops
     if: >-
       !contains(github.event.head_commit.message, '[skip ci]') &&
       github.actor != 'github-actions[bot]'
@@ -41,123 +59,381 @@ jobs:
           token: ${{ secrets.GH_TOKEN || github.token }}
           fetch-depth: 0
 
-      - name: Extract version from README.md
+      - name: Setup MokoStandards tools
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
+          COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
+        run: |
+          git clone --depth 1 --branch version/04.04 --quiet \
+            "https://x-access-token:${GH_TOKEN}@github.com/mokoconsulting-tech/MokoStandards.git" \
+            /tmp/mokostandards
+          cd /tmp/mokostandards
+          composer install --no-dev --no-interaction --quiet
+
+      # ── STEP 1: Read version ───────────────────────────────────────────
+      - name: "Step 1: Read version from README.md"
         id: version
         run: |
-          VERSION=$(grep -oP '^\s*VERSION:\s*\K[0-9]{2}\.[0-9]{2}\.[0-9]{2}' README.md | head -1)
+          VERSION=$(php /tmp/mokostandards/api/cli/version_read.php --path . 2>/dev/null)
           if [ -z "$VERSION" ]; then
-            echo "⚠️ No VERSION found in README.md — skipping release"
+            echo "⏭️ No VERSION in README.md — skipping release"
             echo "skip=true" >> "$GITHUB_OUTPUT"
             exit 0
           fi
+          # Derive major.minor for branch naming (patches update existing branch)
+          MINOR=$(echo "$VERSION" | awk -F. '{printf "%s.%s", $1, $2}')
+          PATCH=$(echo "$VERSION" | awk -F. '{print $3}')
+
           echo "version=$VERSION" >> "$GITHUB_OUTPUT"
           echo "tag=v${VERSION}" >> "$GITHUB_OUTPUT"
+          echo "branch=version/${MINOR}" >> "$GITHUB_OUTPUT"
+          echo "minor=$MINOR" >> "$GITHUB_OUTPUT"
           echo "skip=false" >> "$GITHUB_OUTPUT"
-          echo "✅ Version: $VERSION (tag: v${VERSION})"
+          if [ "$PATCH" = "00" ]; then
+            echo "is_minor=true" >> "$GITHUB_OUTPUT"
+            echo "✅ Version: $VERSION (minor release — full pipeline)"
+          else
+            echo "is_minor=false" >> "$GITHUB_OUTPUT"
+            echo "✅ Version: $VERSION (patch — platform version + badges only)"
+          fi
 
-      - name: Check if tag already exists
+      - name: Check if already released
         if: steps.version.outputs.skip != 'true'
-        id: tag_check
+        id: check
         run: |
           TAG="${{ steps.version.outputs.tag }}"
-          if git rev-parse "$TAG" >/dev/null 2>&1; then
+          BRANCH="${{ steps.version.outputs.branch }}"
-            echo "ℹ️ Tag $TAG already exists — skipping release"
+
-            echo "exists=true" >> "$GITHUB_OUTPUT"
+          TAG_EXISTS=false
+          BRANCH_EXISTS=false
+
+          git rev-parse "$TAG" >/dev/null 2>&1 && TAG_EXISTS=true
+          git ls-remote --heads origin "$BRANCH" 2>/dev/null | grep -q "$BRANCH" && BRANCH_EXISTS=true
+
+          echo "tag_exists=$TAG_EXISTS" >> "$GITHUB_OUTPUT"
+          echo "branch_exists=$BRANCH_EXISTS" >> "$GITHUB_OUTPUT"
+
+          if [ "$TAG_EXISTS" = "true" ] && [ "$BRANCH_EXISTS" = "true" ]; then
+            echo "already_released=true" >> "$GITHUB_OUTPUT"
           else
-            echo "exists=false" >> "$GITHUB_OUTPUT"
+            echo "already_released=false" >> "$GITHUB_OUTPUT"
           fi
 
-      - name: Update Dolibarr module version
+      # ── SANITY CHECKS ────────────────────────────────────────────────────
+      - name: "Sanity: Platform-specific validation"
         if: >-
           steps.version.outputs.skip != 'true' &&
-          steps.tag_check.outputs.exists != 'true'
+          steps.check.outputs.already_released != 'true'
         run: |
-          PLATFORM=""
+          VERSION="${{ steps.version.outputs.version }}"
-          if [ -f ".moko-standards" ]; then
+          PLATFORM=$(php /tmp/mokostandards/api/cli/platform_detect.php --path . 2>/dev/null)
-            PLATFORM=$(grep -E '^platform:' .moko-standards | sed 's/.*:[[:space:]]*//' | tr -d '"')
+          ERRORS=0
+
+          echo "## 🔍 Pre-Release Sanity Checks" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Platform: \`${PLATFORM}\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          # Common checks
+          if [ ! -f "LICENSE" ]; then
+            echo "❌ Missing LICENSE file" >> $GITHUB_STEP_SUMMARY
+            ERRORS=$((ERRORS+1))
+          else
+            echo "✅ LICENSE" >> $GITHUB_STEP_SUMMARY
           fi
 
+          if [ ! -d "src" ]; then
+            echo "⚠️ No src/ directory" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "✅ src/ directory" >> $GITHUB_STEP_SUMMARY
+          fi
+
+          # Dolibarr-specific checks
+          if [ "$PLATFORM" = "crm-module" ]; then
+            MOD_FILE=$(find src htdocs -path "*/core/modules/mod*.class.php" -print -quit 2>/dev/null)
+            if [ -z "$MOD_FILE" ]; then
+              echo "❌ No module descriptor (src/core/modules/mod*.class.php)" >> $GITHUB_STEP_SUMMARY
+              ERRORS=$((ERRORS+1))
+            else
+              echo "✅ Module descriptor: \`${MOD_FILE}\`" >> $GITHUB_STEP_SUMMARY
+
+              # Check module number
+              NUMERO=$(grep -oP '\$this->numero\s*=\s*\K\d+' "$MOD_FILE" 2>/dev/null || echo "0")
+              if [ "$NUMERO" = "0" ] || [ -z "$NUMERO" ]; then
+                echo "❌ Module number (\$this->numero) is 0 or not set" >> $GITHUB_STEP_SUMMARY
+                ERRORS=$((ERRORS+1))
+              else
+                echo "✅ Module number: ${NUMERO}" >> $GITHUB_STEP_SUMMARY
+              fi
+
+              # Check url_last_version exists
+              if grep -q 'url_last_version' "$MOD_FILE" 2>/dev/null; then
+                echo "✅ url_last_version is set" >> $GITHUB_STEP_SUMMARY
+              else
+                echo "⚠️ url_last_version not set — update checks won't work" >> $GITHUB_STEP_SUMMARY
+              fi
+            fi
+          fi
+
+          # Joomla-specific checks
+          if [ "$PLATFORM" = "waas-component" ]; then
+            MANIFEST=$(find . -maxdepth 2 -name "*.xml" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
+            if [ -z "$MANIFEST" ]; then
+              echo "❌ No Joomla XML manifest found" >> $GITHUB_STEP_SUMMARY
+              ERRORS=$((ERRORS+1))
+            else
+              echo "✅ Manifest: \`${MANIFEST}\`" >> $GITHUB_STEP_SUMMARY
+
+              # Check extension type
+              TYPE=$(grep -oP '<extension[^>]+type="\K[^"]+' "$MANIFEST" 2>/dev/null)
+              echo "✅ Extension type: ${TYPE:-unknown}" >> $GITHUB_STEP_SUMMARY
+            fi
+          fi
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          if [ "$ERRORS" -gt 0 ]; then
+            echo "**❌ ${ERRORS} error(s) — release may be incomplete**" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "**✅ All sanity checks passed**" >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # ── STEP 2: Create or update version/XX.YY branch ──────────────────
+      - name: "Step 2: Version branch"
+        if: >-
+          steps.version.outputs.skip != 'true' &&
+          steps.check.outputs.already_released != 'true'
+        run: |
+          BRANCH="${{ steps.version.outputs.branch }}"
+          IS_MINOR="${{ steps.version.outputs.is_minor }}"
+          if [ "$IS_MINOR" = "true" ]; then
+            git checkout -b "$BRANCH" 2>/dev/null || git checkout "$BRANCH"
+            git push origin "$BRANCH" --force
+            echo "🌿 Created branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
+          else
+            git push origin HEAD:"$BRANCH" --force
+            echo "📝 Updated branch: ${BRANCH} (patch)" >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # ── STEP 3: Set platform version ───────────────────────────────────
+      - name: "Step 3: Set platform version"
+        if: >-
+          steps.version.outputs.skip != 'true' &&
+          steps.check.outputs.already_released != 'true'
+        run: |
           VERSION="${{ steps.version.outputs.version }}"
+          php /tmp/mokostandards/api/cli/version_set_platform.php \
+            --path . --version "$VERSION" --branch main
+
+      # ── STEP 4: Update version badges ──────────────────────────────────
+      - name: "Step 4: Update version badges"
+        if: >-
+          steps.version.outputs.skip != 'true' &&
+          steps.check.outputs.already_released != 'true'
+        run: |
+          VERSION="${{ steps.version.outputs.version }}"
+          find . -name "*.md" ! -path "./.git/*" ! -path "./vendor/*" | while read -r f; do
+            if grep -q '\[VERSION:' "$f" 2>/dev/null; then
+              sed -i "s/\[VERSION:[[:space:]]*[0-9]\{2\}\.[0-9]\{2\}\.[0-9]\{2\}\]/[VERSION: ${VERSION}]/" "$f"
+            fi
+          done
+
+      # ── STEP 5: Write update files (Dolibarr: update.txt / Joomla: update.xml)
+      - name: "Step 5: Write update files"
+        if: >-
+          steps.version.outputs.skip != 'true' &&
+          steps.check.outputs.already_released != 'true'
+        run: |
+          PLATFORM=$(php /tmp/mokostandards/api/cli/platform_detect.php --path . 2>/dev/null)
+          VERSION="${{ steps.version.outputs.version }}"
+          REPO="${{ github.repository }}"
 
           if [ "$PLATFORM" = "crm-module" ]; then
-            echo "📦 Dolibarr release — setting module version to '${VERSION}'"
+            printf '%s' "$VERSION" > update.txt
-            # Update $this->version in the module descriptor (core/modules/mod*.class.php)
+            echo "📦 update.txt: ${VERSION}" >> $GITHUB_STEP_SUMMARY
-            find . -path "*/core/modules/mod*.class.php" -exec \
-              sed -i "s/\(\$this->version\s*=\s*\)['\"][^'\"]*['\"]/\1'${VERSION}'/" {} + 2>/dev/null || true
           fi
 
           if [ "$PLATFORM" = "waas-component" ]; then
-            echo "📦 Joomla release — setting manifest version to '${VERSION}'"
+            # ── Parse extension metadata from XML manifest ──────────────
-            # Update <version> tag in Joomla XML manifest files
+            MANIFEST=$(find . -maxdepth 2 -name "*.xml" -exec grep -l '<extension' {} \; 2>/dev/null | head -1)
-            find . -maxdepth 2 -name "*.xml" -exec grep -l '<extension' {} \; 2>/dev/null | while read -r manifest; do
+            if [ -z "$MANIFEST" ]; then
-              sed -i "s|<version>[^<]*</version>|<version>${VERSION}</version>|" "$manifest" 2>/dev/null || true
+              echo "⚠️ No Joomla XML manifest found — skipping update.xml" >> $GITHUB_STEP_SUMMARY
-            done
+            else
+              EXT_NAME=$(grep -oP '<name>\K[^<]+' "$MANIFEST" 2>/dev/null | head -1 || echo "${{ github.event.repository.name }}")
+              EXT_TYPE=$(grep -oP '<extension[^>]+type="\K[^"]+' "$MANIFEST" 2>/dev/null || echo "component")
+              EXT_ELEMENT=$(grep -oP '<element>\K[^<]+' "$MANIFEST" 2>/dev/null | head -1 || echo "")
+              EXT_CLIENT=$(grep -oP '<extension[^>]+client="\K[^"]+' "$MANIFEST" 2>/dev/null || echo "")
+              EXT_FOLDER=$(grep -oP '<extension[^>]+group="\K[^"]+' "$MANIFEST" 2>/dev/null || echo "")
+              TARGET_PLATFORM=$(grep -oP '<targetplatform[^/]*/>' "$MANIFEST" 2>/dev/null | head -1 || echo "")
+              PHP_MINIMUM=$(grep -oP '<php_minimum>\K[^<]+' "$MANIFEST" 2>/dev/null | head -1 || echo "")
+
+              # Derive element from manifest filename if not in XML
+              if [ -z "$EXT_ELEMENT" ]; then
+                EXT_ELEMENT=$(basename "$MANIFEST" .xml)
+              fi
+
+              # Build client tag: plugins and frontend modules need <client>site</client>
+              CLIENT_TAG=""
+              if [ -n "$EXT_CLIENT" ]; then
+                CLIENT_TAG="<client>${EXT_CLIENT}</client>"
+              elif [ "$EXT_TYPE" = "module" ] || [ "$EXT_TYPE" = "plugin" ]; then
+                CLIENT_TAG="<client>site</client>"
+              fi
+
+              # Build folder tag for plugins (required for Joomla to match the update)
+              FOLDER_TAG=""
+              if [ -n "$EXT_FOLDER" ] && [ "$EXT_TYPE" = "plugin" ]; then
+                FOLDER_TAG="<folder>${EXT_FOLDER}</folder>"
+              fi
+
+              # Build targetplatform (fallback to Joomla 5+6 if not in manifest)
+              if [ -z "$TARGET_PLATFORM" ]; then
+                TARGET_PLATFORM=$(printf '<targetplatform name="joomla" version="5.*" %s>' "/")
+              fi
+
+              # Build php_minimum tag
+              PHP_TAG=""
+              if [ -n "$PHP_MINIMUM" ]; then
+                PHP_TAG="<php_minimum>${PHP_MINIMUM}</php_minimum>"
+              fi
+
+              DOWNLOAD_URL="https://github.com/${REPO}/releases/download/v${VERSION}/${EXT_ELEMENT}-${VERSION}.zip"
+              INFO_URL="https://github.com/${REPO}/releases/tag/v${VERSION}"
+
+              # ── Write update.xml (stable release) ───────────────────────
+              {
+                printf '%s\n' '<?xml version="1.0" encoding="utf-8"?>'
+                printf '%s\n' '<updates>'
+                printf '%s\n' '  <update>'
+                printf '%s\n' "    <name>${EXT_NAME}</name>"
+                printf '%s\n' "    <description>${EXT_NAME} update</description>"
+                printf '%s\n' "    <element>${EXT_ELEMENT}</element>"
+                printf '%s\n' "    <type>${EXT_TYPE}</type>"
+                printf '%s\n' "    <version>${VERSION}</version>"
+                [ -n "$CLIENT_TAG" ] && printf '%s\n' "    ${CLIENT_TAG}"
+                [ -n "$FOLDER_TAG" ] && printf '%s\n' "    ${FOLDER_TAG}"
+                printf '%s\n' '    <tags>'
+                printf '%s\n' '      <tag>stable</tag>'
+                printf '%s\n' '    </tags>'
+                printf '%s\n' "    <infourl title=\"${EXT_NAME}\">${INFO_URL}</infourl>"
+                printf '%s\n' '    <downloads>'
+                printf '%s\n' "      <downloadurl type=\"full\" format=\"zip\">${DOWNLOAD_URL}</downloadurl>"
+                printf '%s\n' '    </downloads>'
+                printf '%s\n' "    ${TARGET_PLATFORM}"
+                [ -n "$PHP_TAG" ] && printf '%s\n' "    ${PHP_TAG}"
+                printf '%s\n' '    <maintainer>Moko Consulting</maintainer>'
+                printf '%s\n' '    <maintainerurl>https://mokoconsulting.tech</maintainerurl>'
+                printf '%s\n' '  </update>'
+                printf '%s\n' '</updates>'
+              } > update.xml
+
+              echo "📦 update.xml: ${VERSION} (stable) — ${EXT_TYPE}/${EXT_ELEMENT}" >> $GITHUB_STEP_SUMMARY
+            fi
           fi
 
-          # Commit the version update if anything changed
+      # ── Commit all changes ─────────────────────────────────────────────
-          if ! git diff --quiet; then
+      - name: Commit release changes
-            git config --local user.email "github-actions[bot]@users.noreply.github.com"
-            git config --local user.name "github-actions[bot]"
-            git add -A
-            git commit -m "chore(release): set version to ${VERSION} [skip ci]" \
-              --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
-            git push
-          fi
-
-      - name: Extract changelog entry
         if: >-
           steps.version.outputs.skip != 'true' &&
-          steps.tag_check.outputs.exists != 'true'
+          steps.check.outputs.already_released != 'true'
-        id: changelog
         run: |
+          if git diff --quiet && git diff --cached --quiet; then
+            echo "ℹ️ No changes to commit"
+            exit 0
+          fi
           VERSION="${{ steps.version.outputs.version }}"
+          git config --local user.email "github-actions[bot]@users.noreply.github.com"
+          git config --local user.name "github-actions[bot]"
+          git add -A
+          git commit -m "chore(release): build ${VERSION} [skip ci]" \
+            --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+          git push
 
-          # Try to extract the section for this version from CHANGELOG.md
+      # ── STEP 6: Create tag ─────────────────────────────────────────────
-          NOTES=""
+      - name: "Step 6: Create git tag"
-          if [ -f "CHANGELOG.md" ]; then
-            # Extract text between this version's heading and the next heading
-            NOTES=$(awk "/^##.*${VERSION}/,/^## /" CHANGELOG.md | head -50 | sed '1d;$d')
-          fi
-
-          if [ -z "$NOTES" ]; then
-            NOTES="Release ${VERSION}"
-          fi
-
-          # Write to file to avoid shell escaping issues
-          echo "$NOTES" > /tmp/release_notes.md
-          echo "✅ Release notes prepared"
-
-      - name: Create tag and release
         if: >-
           steps.version.outputs.skip != 'true' &&
-          steps.tag_check.outputs.exists != 'true'
+          steps.check.outputs.tag_exists != 'true'
+        run: |
+          TAG="${{ steps.version.outputs.tag }}"
+          git tag "$TAG"
+          git push origin "$TAG"
+          echo "🏷️ Tag: ${TAG}" >> $GITHUB_STEP_SUMMARY
+
+      # ── STEP 7: Create or update GitHub Release ──────────────────────────
+      - name: "Step 7: GitHub Release"
+        if: >-
+          steps.version.outputs.skip != 'true' &&
+          steps.check.outputs.tag_exists != 'true'
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         run: |
-          TAG="${{ steps.version.outputs.tag }}"
           VERSION="${{ steps.version.outputs.version }}"
+          TAG="${{ steps.version.outputs.tag }}"
+          BRANCH="${{ steps.version.outputs.branch }}"
+          IS_MINOR="${{ steps.version.outputs.is_minor }}"
 
-          # Create the tag
+          # Derive the minor version base (XX.YY.00)
-          git tag "$TAG"
+          MINOR_BASE=$(echo "$VERSION" | sed 's/\.[0-9]*$/.00/')
-          git push origin "$TAG"
+          MINOR_TAG="v${MINOR_BASE}"
 
-          # Create the release
+          NOTES=$(php /tmp/mokostandards/api/cli/release_notes.php --path . --version "$VERSION" 2>/dev/null)
-          gh release create "$TAG" \
+          [ -z "$NOTES" ] && NOTES="Release ${VERSION}"
-            --title "${VERSION}" \
+          echo "$NOTES" > /tmp/release_notes.md
-            --notes-file /tmp/release_notes.md \
-            --target main
 
-          echo "🚀 Release ${VERSION} created: $TAG"
+          if [ "$IS_MINOR" = "true" ]; then
+            # Minor release: create new GitHub Release
+            gh release create "$TAG" \
+              --title "${VERSION}" \
+              --notes-file /tmp/release_notes.md \
+              --target "$BRANCH"
+            echo "🚀 Release created: ${VERSION}" >> $GITHUB_STEP_SUMMARY
+          else
+            # Patch release: update the existing minor release with new tag
+            # Find the latest release for this minor version
+            EXISTING=$(gh release view "$MINOR_TAG" --json tagName -q .tagName 2>/dev/null || true)
+            if [ -n "$EXISTING" ]; then
+              # Update existing release body with patch info
+              CURRENT_NOTES=$(gh release view "$MINOR_TAG" --json body -q .body 2>/dev/null || true)
+              {
+                echo "$CURRENT_NOTES"
+                echo ""
+                echo "---"
+                echo "### Patch ${VERSION}"
+                echo ""
+                cat /tmp/release_notes.md
+              } > /tmp/updated_notes.md
 
-      - name: Summary
+              gh release edit "$MINOR_TAG" \
-        if: steps.version.outputs.skip != 'true'
+                --title "${MINOR_BASE} (latest: ${VERSION})" \
+                --notes-file /tmp/updated_notes.md
+              echo "📝 Release updated: ${MINOR_BASE} → patch ${VERSION}" >> $GITHUB_STEP_SUMMARY
+            else
+              # No existing minor release found — create one for this patch
+              gh release create "$TAG" \
+                --title "${VERSION}" \
+                --notes-file /tmp/release_notes.md
+              echo "🚀 Release created: ${VERSION} (no minor release found)" >> $GITHUB_STEP_SUMMARY
+            fi
+          fi
+
+      # ── Summary ────────────────────────────────────────────────────────
+      - name: Pipeline Summary
+        if: always()
         run: |
           VERSION="${{ steps.version.outputs.version }}"
-          TAG="${{ steps.version.outputs.tag }}"
+          if [ "${{ steps.version.outputs.skip }}" = "true" ]; then
-          if [ "${{ steps.tag_check.outputs.exists }}" = "true" ]; then
+            echo "## ⏭️ Release Skipped" >> $GITHUB_STEP_SUMMARY
-            echo "## ℹ️ Release — ${VERSION}" >> $GITHUB_STEP_SUMMARY
+            echo "No VERSION in README.md" >> $GITHUB_STEP_SUMMARY
-            echo "Tag \`${TAG}\` already exists — no new release created." >> $GITHUB_STEP_SUMMARY
+          elif [ "${{ steps.check.outputs.already_released }}" = "true" ]; then
+            echo "## ℹ️ Already Released — ${VERSION}" >> $GITHUB_STEP_SUMMARY
           else
-            echo "## 🚀 Release — ${VERSION}" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
-            echo "Created tag \`${TAG}\` and GitHub Release." >> $GITHUB_STEP_SUMMARY
+            echo "## ✅ Build & Release Complete" >> $GITHUB_STEP_SUMMARY
+            echo "" >> $GITHUB_STEP_SUMMARY
+            echo "| Step | Result |" >> $GITHUB_STEP_SUMMARY
+            echo "|------|--------|" >> $GITHUB_STEP_SUMMARY
+            echo "| Version | \`${VERSION}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Branch | \`${{ steps.version.outputs.branch }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Tag | \`${{ steps.version.outputs.tag }}\` |" >> $GITHUB_STEP_SUMMARY
+            echo "| Release | [View](https://github.com/${{ github.repository }}/releases/tag/${{ steps.version.outputs.tag }}) |" >> $GITHUB_STEP_SUMMARY
           fi

.github/workflows/codeql-analysis.yml

@@ -5,15 +5,17 @@
 # SPDX-License-Identifier: GPL-3.0-or-later
 #
 # FILE INFORMATION
-# DEFGROUP: GitHub.Workflow
+# DEFGROUP: GitHub.Workflow.Template
 # INGROUP: MokoStandards.Security
 # REPO: https://github.com/mokoconsulting-tech/MokoStandards
-# PATH: /.github/workflows/codeql-analysis.yml
+# PATH: /templates/workflows/generic/codeql-analysis.yml.template
-# VERSION: 04.01.00
+# VERSION: 04.04.01
-# BRIEF: CodeQL security scanning workflow for PHP codebase
+# BRIEF: CodeQL security scanning workflow (generic — all repo types)
-# NOTE: Repository is PHP-only (v04.00.04). Python was removed Feb 12, 2026.
+# NOTE: Deployed to .github/workflows/codeql-analysis.yml in governed repos.
+#       CodeQL does not support PHP directly; JavaScript scans JSON/YAML/shell.
+#       For PHP-specific security scanning see standards-compliance.yml.
 
-name: "CodeQL Security Scanning"
+name: CodeQL Security Scanning
 
 on:
   push:
@@ -28,7 +30,7 @@ on:
       - dev/**
       - rc/**
   schedule:
-    # Run weekly on Monday at 6:00 AM UTC
+    # Weekly on Monday at 06:00 UTC
     - cron: '0 6 * * 1'
   workflow_dispatch:
 
@@ -40,65 +42,60 @@ permissions:
 
 jobs:
   analyze:
-    name: Configuration Security Scan
+    name: Analyze (${{ matrix.language }})
     runs-on: ubuntu-latest
     timeout-minutes: 360
 
-    # No language matrix - PHP-only repository
+    strategy:
-    # CodeQL scans workflow files, configs, and scripts for security issues
+      fail-fast: false
-    # PHP security handled by SecurityValidator enterprise library
+      matrix:
+        # CodeQL does not support PHP. Use 'javascript' to scan JSON, YAML,
+        # and shell scripts. Add 'actions' to scan GitHub Actions workflows.
+        language: ['javascript', 'actions']
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
+        uses: github/codeql-action/init@v3
         with:
-          # No languages specified - scan configurations only
+          languages: ${{ matrix.language }}
-          # Reference explicit config to scan YAML, JSON, shell scripts
-          config-file: ./.github/codeql/codeql-config.yml
-          # Use security-extended query suite for comprehensive coverage
           queries: security-extended,security-and-quality
 
-      # Skip autobuild - no code compilation needed for config scanning
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@0d579ffd059c29b07949a3cce3983f0780820c98 # v4
+        uses: github/codeql-action/analyze@v3
         with:
-          category: "/language:config"
+          category: "/language:${{ matrix.language }}"
           upload: true
           output: sarif-results
           wait-for-processing: true
 
-      - name: Upload SARIF results (optional)
+      - name: Upload SARIF results
         if: always()
-        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v4.5.0
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.5.0
         with:
-          name: codeql-results-config
+          name: codeql-results-${{ matrix.language }}
           path: sarif-results
           retention-days: 30
 
-      - name: Check for Critical/High Findings
+      - name: Step summary
         if: always()
         run: |
-          echo "### 🔍 CodeQL Security Analysis Complete" >> $GITHUB_STEP_SUMMARY
+          echo "### 🔍 CodeQL — ${{ matrix.language }}" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Scan Type**: Configuration Security" >> $GITHUB_STEP_SUMMARY
-          echo "**Query Suite**: security-extended, security-and-quality" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Note**: MokoStandards is PHP-only (v04.00.04)." >> $GITHUB_STEP_SUMMARY
-          echo "This scan analyzes workflow files, JSON configs, YAML, and shell scripts." >> $GITHUB_STEP_SUMMARY
-          echo "For PHP-specific security: Use PHP SecurityValidator enterprise library." >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
           URL="https://github.com/${{ github.repository }}/security/code-scanning"
-          echo "Check the [Security tab]($URL) for detailed findings." >> $GITHUB_STEP_SUMMARY
+          echo "See the [Security tab]($URL) for findings." >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Response Requirements**:" >> $GITHUB_STEP_SUMMARY
+          echo "| Severity | SLA |" >> $GITHUB_STEP_SUMMARY
-          echo "- Critical: Fix within 7 days" >> $GITHUB_STEP_SUMMARY
+          echo "|----------|-----|" >> $GITHUB_STEP_SUMMARY
-          echo "- High: Fix within 14 days" >> $GITHUB_STEP_SUMMARY
+          echo "| Critical | 7 days |" >> $GITHUB_STEP_SUMMARY
-          echo "- Medium: Fix within 30 days" >> $GITHUB_STEP_SUMMARY
+          echo "| High     | 14 days |" >> $GITHUB_STEP_SUMMARY
-          echo "- Low: Fix within 60 days or next release" >> $GITHUB_STEP_SUMMARY
+          echo "| Medium   | 30 days |" >> $GITHUB_STEP_SUMMARY
+          echo "| Low      | 60 days / next release |" >> $GITHUB_STEP_SUMMARY
 
   summary:
     name: Security Scan Summary
@@ -107,17 +104,12 @@ jobs:
     if: always()
 
     steps:
-      - name: Generate Summary
+      - name: Summary
         run: |
-          echo "### 🛡️ Security Scanning Complete" >> $GITHUB_STEP_SUMMARY
+          echo "### 🛡️ CodeQL Complete" >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "All CodeQL security scans have completed." >> $GITHUB_STEP_SUMMARY
-          echo "" >> $GITHUB_STEP_SUMMARY
-          echo "**Trigger**: ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
-          echo "**Branch**: ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
+          echo "**Trigger:** ${{ github.event_name }}" >> $GITHUB_STEP_SUMMARY
+          echo "**Branch:** ${{ github.ref_name }}" >> $GITHUB_STEP_SUMMARY
           SECURITY_URL="https://github.com/${{ github.repository }}/security"
+          echo "" >> $GITHUB_STEP_SUMMARY
           echo "📊 [View all security alerts]($SECURITY_URL)" >> $GITHUB_STEP_SUMMARY
-          POLICY_URL="https://github.com/${{ github.repository }}"
-          POLICY_URL="${POLICY_URL}/blob/main/docs/policy/security-scanning.md"
-          echo "📋 [Security scanning policy]($POLICY_URL)" >> $GITHUB_STEP_SUMMARY

.github/workflows/deploy-demo.yml

@@ -21,8 +21,8 @@
 # DEFGROUP: GitHub.Workflow
 # INGROUP: MokoStandards.Deploy
 # REPO: https://github.com/mokoconsulting-tech/MokoStandards
-# PATH: /templates/workflows/shared/deploy-demo.yml
+# PATH: /templates/workflows/shared/deploy-demo.yml.template
-# VERSION: 04.01.00
+# VERSION: 04.04.01
 # BRIEF: SFTP deployment workflow for demo server — synced to all governed repos
 # NOTE: Synced via bulk-repo-sync to .github/workflows/deploy-demo.yml in all governed repos.
 #       Port is resolved in order: DEMO_FTP_PORT variable → :port suffix in DEMO_FTP_HOST → 22.
@@ -51,6 +51,7 @@ on:
       - master
     paths:
       - 'src/**'
+      - 'htdocs/**'
   pull_request:
     types: [opened, synchronize, reopened, closed]
     branches:
@@ -58,6 +59,7 @@ on:
       - master
     paths:
       - 'src/**'
+      - 'htdocs/**'
   workflow_dispatch:
     inputs:
       clear_remote:
@@ -70,6 +72,9 @@ permissions:
   contents: read
   pull-requests: write
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   check-permission:
     name: Verify Deployment Permission
@@ -170,16 +175,20 @@ jobs:
       - name: Resolve source directory
         id: source
         run: |
-          SRC="src"
+          # Resolve source directory: src/ preferred, htdocs/ as fallback
-          if [ ! -d "$SRC" ]; then
+          if [ -d "src" ]; then
-            echo "⚠️ No src/ directory found — skipping deployment"
+            SRC="src"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
+          elif [ -d "htdocs" ]; then
+            SRC="htdocs"
           else
-            COUNT=$(find "$SRC" -maxdepth 0 -type d > /dev/null && find "$SRC" -type f | wc -l)
+            echo "⚠️ No src/ or htdocs/ directory found — skipping deployment"
-            echo "✅ Source: src/ (${COUNT} file(s))"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
-            echo "skip=false" >> "$GITHUB_OUTPUT"
+            exit 0
-            echo "dir=${SRC}"  >> "$GITHUB_OUTPUT"
           fi
+          COUNT=$(find "$SRC" -type f | wc -l)
+          echo "✅ Source: ${SRC}/ (${COUNT} file(s))"
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+          echo "dir=${SRC}"  >> "$GITHUB_OUTPUT"
 
       - name: Preview files to deploy
         if: steps.source.outputs.skip == 'false'
@@ -241,7 +250,6 @@ jobs:
               fi
             done
             $SKIP && continue
-            if [ -f ".gitignore" ]; then
             if [ -f ".gitignore" ]; then
               git check-ignore -q "$rel" 2>/dev/null && {
                 IGNORED_FILES+=("$rel | .gitignore")
@@ -345,8 +353,8 @@ jobs:
 
           # ── Platform-specific path safety guards ──────────────────────────────
           PLATFORM=""
-          if [ -f ".moko-standards" ]; then
+          MOKO_FILE=".github/.mokostandards"; [ ! -f "$MOKO_FILE" ] && MOKO_FILE=".mokostandards"; if [ -f "$MOKO_FILE" ]; then
-            PLATFORM=$(grep -E '^platform:' .moko-standards | sed 's/.*:[[:space:]]*//' | tr -d '"')
+            PLATFORM=$(grep -E '^platform:' "$MOKO_FILE" | sed 's/.*:[[:space:]]*//' | tr -d '"')
           fi
 
           if [ "$PLATFORM" = "crm-module" ]; then
@@ -407,7 +415,7 @@ jobs:
 
       - name: Setup PHP
         if: steps.source.outputs.skip == 'false' && steps.remote.outputs.skip != 'true'
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.31.0
+        uses: shivammathur/setup-php@fcafdd6392932010c2bd5094439b8e33be2a8a09 # v2.37.0
         with:
           php-version: '8.1'
           tools: composer
@@ -418,14 +426,17 @@ jobs:
           GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
         run: |
-          git clone --depth 1 --quiet \
+          git clone --depth 1 --branch version/04.04 --quiet \
             "https://x-access-token:${GH_TOKEN}@github.com/mokoconsulting-tech/MokoStandards.git" \
             /tmp/mokostandards
           cd /tmp/mokostandards
           composer install --no-dev --no-interaction --quiet
 
-      - name: Clear remote destination folder
+      - name: Clear remote destination folder (manual only)
-        if: steps.source.outputs.skip == 'false' && steps.remote.outputs.skip != 'true'
+        if: >-
+          steps.source.outputs.skip == 'false' &&
+          steps.remote.outputs.skip != 'true' &&
+          inputs.clear_remote == true
         env:
           SFTP_HOST:      ${{ steps.conn.outputs.host }}
           SFTP_PORT:      ${{ steps.conn.outputs.port }}
@@ -566,6 +577,60 @@ jobs:
               > /tmp/sftp-config.json
           fi
 
+          # ── Write update files (demo = stable) ─────────────────────────────
+          PLATFORM=$(php /tmp/mokostandards/api/cli/platform_detect.php --path . 2>/dev/null || true)
+          VERSION=$(php /tmp/mokostandards/api/cli/version_read.php --path . 2>/dev/null || echo "unknown")
+          REPO="${{ github.repository }}"
+
+          if [ "$PLATFORM" = "crm-module" ]; then
+            printf '%s' "$VERSION" > update.txt
+          fi
+
+          if [ "$PLATFORM" = "waas-component" ]; then
+            MANIFEST=$(find . -maxdepth 2 -name "*.xml" -exec grep -l '<extension' {} \; 2>/dev/null | head -1 || true)
+            if [ -n "$MANIFEST" ]; then
+              EXT_NAME=$(grep -oP '<name>\K[^<]+' "$MANIFEST" 2>/dev/null | head -1 || echo "${{ github.event.repository.name }}")
+              EXT_TYPE=$(grep -oP '<extension[^>]+type="\K[^"]+' "$MANIFEST" 2>/dev/null || echo "component")
+              EXT_ELEMENT=$(grep -oP '<element>\K[^<]+' "$MANIFEST" 2>/dev/null | head -1 || basename "$MANIFEST" .xml)
+              EXT_CLIENT=$(grep -oP '<extension[^>]+client="\K[^"]+' "$MANIFEST" 2>/dev/null || echo "")
+              EXT_FOLDER=$(grep -oP '<extension[^>]+group="\K[^"]+' "$MANIFEST" 2>/dev/null || echo "")
+              TARGET_PLATFORM=$(grep -oP '<targetplatform[^/]*/' "$MANIFEST" 2>/dev/null | head -1 || true)
+              [ -n "$TARGET_PLATFORM" ] && TARGET_PLATFORM="${TARGET_PLATFORM}>"
+              [ -z "$TARGET_PLATFORM" ] && TARGET_PLATFORM=$(printf '<targetplatform name="joomla" version="5.*" %s>' "/")
+
+              CLIENT_TAG=""
+              if [ -n "$EXT_CLIENT" ]; then CLIENT_TAG="<client>${EXT_CLIENT}</client>"; elif [ "$EXT_TYPE" = "module" ] || [ "$EXT_TYPE" = "plugin" ]; then CLIENT_TAG="<client>site</client>"; fi
+              FOLDER_TAG=""
+              if [ -n "$EXT_FOLDER" ] && [ "$EXT_TYPE" = "plugin" ]; then FOLDER_TAG="<folder>${EXT_FOLDER}</folder>"; fi
+
+              DOWNLOAD_URL="https://github.com/${REPO}/releases/download/v${VERSION}/${EXT_ELEMENT}-${VERSION}.zip"
+              {
+                printf '%s\n' '<?xml version="1.0" encoding="utf-8"?>'
+                printf '%s\n' '<updates>'
+                printf '%s\n' '  <update>'
+                printf '%s\n' "    <name>${EXT_NAME}</name>"
+                printf '%s\n' "    <description>${EXT_NAME} update</description>"
+                printf '%s\n' "    <element>${EXT_ELEMENT}</element>"
+                printf '%s\n' "    <type>${EXT_TYPE}</type>"
+                printf '%s\n' "    <version>${VERSION}</version>"
+                [ -n "$CLIENT_TAG" ] && printf '%s\n' "    ${CLIENT_TAG}"
+                [ -n "$FOLDER_TAG" ] && printf '%s\n' "    ${FOLDER_TAG}"
+                printf '%s\n' '    <tags>'
+                printf '%s\n' '      <tag>stable</tag>'
+                printf '%s\n' '    </tags>'
+                printf '%s\n' "    <infourl title=\"${EXT_NAME}\">https://github.com/${REPO}</infourl>"
+                printf '%s\n' '    <downloads>'
+                printf '%s\n' "      <downloadurl type=\"full\" format=\"zip\">${DOWNLOAD_URL}</downloadurl>"
+                printf '%s\n' '    </downloads>'
+                printf '%s\n' "    ${TARGET_PLATFORM}"
+                printf '%s\n' '    <maintainer>Moko Consulting</maintainer>'
+                printf '%s\n' '    <maintainerurl>https://mokoconsulting.tech</maintainerurl>'
+                printf '%s\n' '  </update>'
+                printf '%s\n' '</updates>'
+              } > update.xml
+            fi
+          fi
+
           # ── Run deploy-sftp.php from MokoStandards ────────────────────────────
           DEPLOY_ARGS=(--path . --src-dir "$SOURCE_DIR" --config /tmp/sftp-config.json)
           if [ "$USE_PASSPHRASE" = "true" ]; then
@@ -578,7 +643,7 @@ jobs:
           rm -f /tmp/deploy_key /tmp/sftp-config.json
 
       - name: Create or update failure issue
-        if: failure()
+        if: failure() && steps.remote.outputs.skip != 'true'
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         run: |
@@ -620,7 +685,7 @@ jobs:
             --force 2>/dev/null || true
 
           # Look for an existing open deploy-failure issue
-          EXISTING=$(gh api "repos/${REPO}/issues?labels=${LABEL}&state=open&per_page=1" \
+          EXISTING=$(gh api "repos/${REPO}/issues?labels=${LABEL}&state=all&per_page=1&sort=created&direction=desc" \
             --jq '.[0].number' 2>/dev/null)
 
           if [ -n "$EXISTING" ] && [ "$EXISTING" != "null" ]; then
@@ -628,14 +693,16 @@ jobs:
               -X PATCH \
               -f title="$TITLE" \
               -f body="$BODY" \
+              -f state="open" \
               --silent
-            echo "📋 Failure issue #${EXISTING} updated: ${REPO}" >> "$GITHUB_STEP_SUMMARY"
+            echo "📋 Failure issue #${EXISTING} updated/reopened: ${REPO}" >> "$GITHUB_STEP_SUMMARY"
           else
             gh issue create \
               --repo "$REPO" \
               --title "$TITLE" \
               --body "$BODY" \
               --label "$LABEL" \
+              --assignee "jmiller-moko" \
               | tee -a "$GITHUB_STEP_SUMMARY"
           fi
 

.github/workflows/deploy-dev.yml

@@ -21,8 +21,8 @@
 # DEFGROUP: GitHub.Workflow
 # INGROUP: MokoStandards.Deploy
 # REPO: https://github.com/mokoconsulting-tech/MokoStandards
-# PATH: /templates/workflows/shared/deploy-dev.yml
+# PATH: /templates/workflows/shared/deploy-dev.yml.template
-# VERSION: 04.01.00
+# VERSION: 04.04.01
 # BRIEF: SFTP deployment workflow for development server — synced to all governed repos
 # NOTE: Synced via bulk-repo-sync to .github/workflows/deploy-dev.yml in all governed repos.
 #       Port is resolved in order: DEV_FTP_PORT variable → :port suffix in DEV_FTP_HOST → 22.
@@ -49,18 +49,22 @@ on:
   push:
     branches:
       - 'dev/**'
+      - 'rc/**'
       - develop
       - development
     paths:
       - 'src/**'
+      - 'htdocs/**'
   pull_request:
     types: [opened, synchronize, reopened, closed]
     branches:
       - 'dev/**'
+      - 'rc/**'
       - develop
       - development
     paths:
       - 'src/**'
+      - 'htdocs/**'
   workflow_dispatch:
     inputs:
       clear_remote:
@@ -73,6 +77,9 @@ permissions:
   contents: read
   pull-requests: write
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   check-permission:
     name: Verify Deployment Permission
@@ -173,16 +180,20 @@ jobs:
       - name: Resolve source directory
         id: source
         run: |
-          SRC="src"
+          # Resolve source directory: src/ preferred, htdocs/ as fallback
-          if [ ! -d "$SRC" ]; then
+          if [ -d "src" ]; then
-            echo "⚠️ No src/ directory found — skipping deployment"
+            SRC="src"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
+          elif [ -d "htdocs" ]; then
+            SRC="htdocs"
           else
-            COUNT=$(find "$SRC" -maxdepth 0 -type d > /dev/null && find "$SRC" -type f | wc -l)
+            echo "⚠️ No src/ or htdocs/ directory found — skipping deployment"
-            echo "✅ Source: src/ (${COUNT} file(s))"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
-            echo "skip=false" >> "$GITHUB_OUTPUT"
+            exit 0
-            echo "dir=${SRC}"  >> "$GITHUB_OUTPUT"
           fi
+          COUNT=$(find "$SRC" -type f | wc -l)
+          echo "✅ Source: ${SRC}/ (${COUNT} file(s))"
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+          echo "dir=${SRC}"  >> "$GITHUB_OUTPUT"
 
       - name: Preview files to deploy
         if: steps.source.outputs.skip == 'false'
@@ -347,8 +358,8 @@ jobs:
 
           # ── Platform-specific path safety guards ──────────────────────────────
           PLATFORM=""
-          if [ -f ".moko-standards" ]; then
+          MOKO_FILE=".github/.mokostandards"; [ ! -f "$MOKO_FILE" ] && MOKO_FILE=".mokostandards"; if [ -f "$MOKO_FILE" ]; then
-            PLATFORM=$(grep -E '^platform:' .moko-standards | sed 's/.*:[[:space:]]*//' | tr -d '"')
+            PLATFORM=$(grep -oP '^platform:.*' "$MOKO_FILE" 2>/dev/null || true)
           fi
 
           if [ "$PLATFORM" = "crm-module" ]; then
@@ -409,7 +420,7 @@ jobs:
 
       - name: Setup PHP
         if: steps.source.outputs.skip == 'false' && steps.remote.outputs.skip != 'true'
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.31.0
+        uses: shivammathur/setup-php@fcafdd6392932010c2bd5094439b8e33be2a8a09 # v2.37.0
         with:
           php-version: '8.1'
           tools: composer
@@ -420,14 +431,17 @@ jobs:
           GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
         run: |
-          git clone --depth 1 --quiet \
+          git clone --depth 1 --branch version/04.04 --quiet \
             "https://x-access-token:${GH_TOKEN}@github.com/mokoconsulting-tech/MokoStandards.git" \
             /tmp/mokostandards
           cd /tmp/mokostandards
           composer install --no-dev --no-interaction --quiet
 
-      - name: Clear remote destination folder
+      - name: Clear remote destination folder (manual only)
-        if: steps.source.outputs.skip == 'false' && steps.remote.outputs.skip != 'true'
+        if: >-
+          steps.source.outputs.skip == 'false' &&
+          steps.remote.outputs.skip != 'true' &&
+          inputs.clear_remote == true
         env:
           SFTP_HOST:      ${{ steps.conn.outputs.host }}
           SFTP_PORT:      ${{ steps.conn.outputs.port }}
@@ -574,23 +588,78 @@ jobs:
             DEPLOY_ARGS+=(--key-passphrase "$SFTP_PASSWORD")
           fi
 
-          # ── For Dolibarr (crm-module): set version to "development" before deploy ─
+          # Set platform version to "development" before deploy (Dolibarr + Joomla)
-          PLATFORM=""
+          php /tmp/mokostandards/api/cli/version_set_platform.php --path . --version development
-          if [ -f ".moko-standards" ]; then
+
-            PLATFORM=$(grep -E '^platform:' .moko-standards | sed 's/.*:[[:space:]]*//' | tr -d '"')
+          # Write update files — dev/** = development, rc/** = rc
+          PLATFORM=$(php /tmp/mokostandards/api/cli/platform_detect.php --path . 2>/dev/null || true)
+          REPO="${{ github.repository }}"
+          BRANCH="${{ github.ref_name }}"
+
+          # Determine stability tag from branch prefix
+          STABILITY="development"
+          VERSION_LABEL="development"
+          if [[ "$BRANCH" == rc/* ]]; then
+            STABILITY="rc"
+            VERSION_LABEL=$(php /tmp/mokostandards/api/cli/version_read.php --path . 2>/dev/null || echo "${BRANCH#rc/}")-rc
           fi
 
           if [ "$PLATFORM" = "crm-module" ]; then
-            echo "📦 Dolibarr dev deploy — setting module version to 'development'"
+            printf '%s' "$VERSION_LABEL" > update.txt
-            find "$SOURCE_DIR" -path "*/core/modules/mod*.class.php" -exec \
-              sed -i "s/\(\$this->version\s*=\s*\)['\"][^'\"]*['\"]/\1'development'/" {} + 2>/dev/null || true
           fi
 
           if [ "$PLATFORM" = "waas-component" ]; then
-            echo "📦 Joomla dev deploy — setting manifest version to 'development'"
+            MANIFEST=$(find . -maxdepth 2 -name "*.xml" -exec grep -l '<extension' {} \; 2>/dev/null | head -1 || true)
-            find "$SOURCE_DIR" -maxdepth 2 -name "*.xml" -exec grep -l '<extension' {} \; 2>/dev/null | while read -r manifest; do
+            if [ -n "$MANIFEST" ]; then
-              sed -i "s|<version>[^<]*</version>|<version>development</version>|" "$manifest" 2>/dev/null || true
+              EXT_NAME=$(grep -oP '<name>\K[^<]+' "$MANIFEST" 2>/dev/null | head -1 || echo "${{ github.event.repository.name }}")
-            done
+              EXT_TYPE=$(grep -oP '<extension[^>]+type="\K[^"]+' "$MANIFEST" 2>/dev/null || echo "component")
+              EXT_ELEMENT=$(grep -oP '<element>\K[^<]+' "$MANIFEST" 2>/dev/null | head -1 || basename "$MANIFEST" .xml)
+              EXT_CLIENT=$(grep -oP '<extension[^>]+client="\K[^"]+' "$MANIFEST" 2>/dev/null || echo "")
+              EXT_FOLDER=$(grep -oP '<extension[^>]+group="\K[^"]+' "$MANIFEST" 2>/dev/null || echo "")
+              TARGET_PLATFORM=$(grep -oP '<targetplatform[^/]*/' "$MANIFEST" 2>/dev/null | head -1 || true)
+              [ -n "$TARGET_PLATFORM" ] && TARGET_PLATFORM="${TARGET_PLATFORM}>"
+              [ -z "$TARGET_PLATFORM" ] && TARGET_PLATFORM=$(printf '<targetplatform name="joomla" version="5.*" %s>' "/")
+
+              CLIENT_TAG=""
+              if [ -n "$EXT_CLIENT" ]; then
+                CLIENT_TAG="<client>${EXT_CLIENT}</client>"
+              elif [ "$EXT_TYPE" = "module" ] || [ "$EXT_TYPE" = "plugin" ]; then
+                CLIENT_TAG="<client>site</client>"
+              fi
+
+              FOLDER_TAG=""
+              if [ -n "$EXT_FOLDER" ] && [ "$EXT_TYPE" = "plugin" ]; then
+                FOLDER_TAG="<folder>${EXT_FOLDER}</folder>"
+              fi
+
+              DOWNLOAD_URL="https://github.com/${REPO}/archive/refs/heads/${BRANCH}.zip"
+
+              {
+                printf '%s\n' '<?xml version="1.0" encoding="utf-8"?>'
+                printf '%s\n' '<updates>'
+                printf '%s\n' '  <update>'
+                printf '%s\n' "    <name>${EXT_NAME}</name>"
+                printf '%s\n' "    <description>${EXT_NAME} ${STABILITY} build</description>"
+                printf '%s\n' "    <element>${EXT_ELEMENT}</element>"
+                printf '%s\n' "    <type>${EXT_TYPE}</type>"
+                printf '%s\n' "    <version>${VERSION_LABEL}</version>"
+                [ -n "$CLIENT_TAG" ] && printf '%s\n' "    ${CLIENT_TAG}"
+                [ -n "$FOLDER_TAG" ] && printf '%s\n' "    ${FOLDER_TAG}"
+                printf '%s\n' '    <tags>'
+                printf '%s\n' "      <tag>${STABILITY}</tag>"
+                printf '%s\n' '    </tags>'
+                printf '%s\n' "    <infourl title=\"${EXT_NAME}\">https://github.com/${REPO}/tree/${BRANCH}</infourl>"
+                printf '%s\n' '    <downloads>'
+                printf '%s\n' "      <downloadurl type=\"full\" format=\"zip\">${DOWNLOAD_URL}</downloadurl>"
+                printf '%s\n' '    </downloads>'
+                printf '%s\n' "    ${TARGET_PLATFORM}"
+                printf '%s\n' '    <maintainer>Moko Consulting</maintainer>'
+                printf '%s\n' '    <maintainerurl>https://mokoconsulting.tech</maintainerurl>'
+                printf '%s\n' '  </update>'
+                printf '%s\n' '</updates>'
+              } > update.xml
+              sed -i '/^[[:space:]]*$/d' update.xml
+            fi
           fi
 
           php /tmp/mokostandards/api/deploy/deploy-sftp.php "${DEPLOY_ARGS[@]}"
@@ -641,7 +710,7 @@ jobs:
             --force 2>/dev/null || true
 
           # Look for an existing open deploy-failure issue
-          EXISTING=$(gh api "repos/${REPO}/issues?labels=${LABEL}&state=open&per_page=1" \
+          EXISTING=$(gh api "repos/${REPO}/issues?labels=${LABEL}&state=all&per_page=1&sort=created&direction=desc" \
             --jq '.[0].number' 2>/dev/null)
 
           if [ -n "$EXISTING" ] && [ "$EXISTING" != "null" ]; then
@@ -649,14 +718,16 @@ jobs:
               -X PATCH \
               -f title="$TITLE" \
               -f body="$BODY" \
+              -f state="open" \
               --silent
-            echo "📋 Failure issue #${EXISTING} updated: ${REPO}" >> "$GITHUB_STEP_SUMMARY"
+            echo "📋 Failure issue #${EXISTING} updated/reopened: ${REPO}" >> "$GITHUB_STEP_SUMMARY"
           else
             gh issue create \
               --repo "$REPO" \
               --title "$TITLE" \
               --body "$BODY" \
               --label "$LABEL" \
+              --assignee "jmiller-moko" \
               | tee -a "$GITHUB_STEP_SUMMARY"
           fi
 

.github/workflows/deploy-rs.yml

@@ -21,8 +21,8 @@
 # DEFGROUP: GitHub.Workflow
 # INGROUP: MokoStandards.Deploy
 # REPO: https://github.com/mokoconsulting-tech/MokoStandards
-# PATH: /templates/workflows/shared/deploy-rs.yml
+# PATH: /templates/workflows/shared/deploy-rs.yml.template
-# VERSION: 04.01.00
+# VERSION: 04.04.01
 # BRIEF: SFTP deployment workflow for release staging server — synced to all governed repos
 # NOTE: Synced via bulk-repo-sync to .github/workflows/deploy-rs.yml in all governed repos.
 #       Port is resolved in order: RS_FTP_PORT variable → :port suffix in RS_FTP_HOST → 22.
@@ -51,6 +51,7 @@ on:
       - master
     paths:
       - 'src/**'
+      - 'htdocs/**'
   pull_request:
     types: [opened, synchronize, reopened, closed]
     branches:
@@ -58,6 +59,7 @@ on:
       - master
     paths:
       - 'src/**'
+      - 'htdocs/**'
   workflow_dispatch:
     inputs:
       clear_remote:
@@ -70,6 +72,9 @@ permissions:
   contents: read
   pull-requests: write
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   check-permission:
     name: Verify Deployment Permission
@@ -170,16 +175,20 @@ jobs:
       - name: Resolve source directory
         id: source
         run: |
-          SRC="src"
+          # Resolve source directory: src/ preferred, htdocs/ as fallback
-          if [ ! -d "$SRC" ]; then
+          if [ -d "src" ]; then
-            echo "⚠️ No src/ directory found — skipping deployment"
+            SRC="src"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
+          elif [ -d "htdocs" ]; then
+            SRC="htdocs"
           else
-            COUNT=$(find "$SRC" -maxdepth 0 -type d > /dev/null && find "$SRC" -type f | wc -l)
+            echo "⚠️ No src/ or htdocs/ directory found — skipping deployment"
-            echo "✅ Source: src/ (${COUNT} file(s))"
+            echo "skip=true" >> "$GITHUB_OUTPUT"
-            echo "skip=false" >> "$GITHUB_OUTPUT"
+            exit 0
-            echo "dir=${SRC}"  >> "$GITHUB_OUTPUT"
           fi
+          COUNT=$(find "$SRC" -type f | wc -l)
+          echo "✅ Source: ${SRC}/ (${COUNT} file(s))"
+          echo "skip=false" >> "$GITHUB_OUTPUT"
+          echo "dir=${SRC}"  >> "$GITHUB_OUTPUT"
 
       - name: Preview files to deploy
         if: steps.source.outputs.skip == 'false'
@@ -344,8 +353,8 @@ jobs:
 
           # ── Platform-specific path safety guards ──────────────────────────────
           PLATFORM=""
-          if [ -f ".moko-standards" ]; then
+          MOKO_FILE=".github/.mokostandards"; [ ! -f "$MOKO_FILE" ] && MOKO_FILE=".mokostandards"; if [ -f "$MOKO_FILE" ]; then
-            PLATFORM=$(grep -E '^platform:' .moko-standards | sed 's/.*:[[:space:]]*//' | tr -d '"')
+            PLATFORM=$(grep -E '^platform:' "$MOKO_FILE" | sed 's/.*:[[:space:]]*//' | tr -d '"')
           fi
 
           # RS deployment: no path restrictions for any platform
@@ -387,7 +396,7 @@ jobs:
 
       - name: Setup PHP
         if: steps.source.outputs.skip == 'false' && steps.remote.outputs.skip != 'true'
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.31.0
+        uses: shivammathur/setup-php@fcafdd6392932010c2bd5094439b8e33be2a8a09 # v2.37.0
         with:
           php-version: '8.1'
           tools: composer
@@ -398,14 +407,17 @@ jobs:
           GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
         run: |
-          git clone --depth 1 --quiet \
+          git clone --depth 1 --branch version/04.04 --quiet \
             "https://x-access-token:${GH_TOKEN}@github.com/mokoconsulting-tech/MokoStandards.git" \
             /tmp/mokostandards
           cd /tmp/mokostandards
           composer install --no-dev --no-interaction --quiet
 
-      - name: Clear remote destination folder
+      - name: Clear remote destination folder (manual only)
-        if: steps.source.outputs.skip == 'false' && steps.remote.outputs.skip != 'true'
+        if: >-
+          steps.source.outputs.skip == 'false' &&
+          steps.remote.outputs.skip != 'true' &&
+          inputs.clear_remote == true
         env:
           SFTP_HOST:      ${{ steps.conn.outputs.host }}
           SFTP_PORT:      ${{ steps.conn.outputs.port }}
@@ -558,7 +570,7 @@ jobs:
           rm -f /tmp/deploy_key /tmp/sftp-config.json
 
       - name: Create or update failure issue
-        if: failure()
+        if: failure() && steps.remote.outputs.skip != 'true'
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         run: |
@@ -599,8 +611,8 @@ jobs:
             --description "Automated deploy failure tracking" \
             --force 2>/dev/null || true
 
-          # Look for an existing open deploy-failure issue
+          # Look for an existing deploy-failure issue (any state — reopen if closed)
-          EXISTING=$(gh api "repos/${REPO}/issues?labels=${LABEL}&state=open&per_page=1" \
+          EXISTING=$(gh api "repos/${REPO}/issues?labels=${LABEL}&state=all&per_page=1&sort=created&direction=desc" \
             --jq '.[0].number' 2>/dev/null)
 
           if [ -n "$EXISTING" ] && [ "$EXISTING" != "null" ]; then
@@ -608,14 +620,16 @@ jobs:
               -X PATCH \
               -f title="$TITLE" \
               -f body="$BODY" \
+              -f state="open" \
               --silent
-            echo "📋 Failure issue #${EXISTING} updated: ${REPO}" >> "$GITHUB_STEP_SUMMARY"
+            echo "📋 Failure issue #${EXISTING} updated/reopened: ${REPO}" >> "$GITHUB_STEP_SUMMARY"
           else
             gh issue create \
               --repo "$REPO" \
               --title "$TITLE" \
               --body "$BODY" \
               --label "$LABEL" \
+              --assignee "jmiller-moko" \
               | tee -a "$GITHUB_STEP_SUMMARY"
           fi
 

.github/workflows/enterprise-firewall-setup.yml

@@ -21,8 +21,8 @@
 # DEFGROUP: GitHub.Workflow
 # INGROUP: MokoStandards.Firewall
 # REPO: https://github.com/mokoconsulting-tech/MokoStandards
-# PATH: /templates/workflows/shared/enterprise-firewall-setup.yml
+# PATH: /templates/workflows/shared/enterprise-firewall-setup.yml.template
-# VERSION: 04.01.00
+# VERSION: 04.04.01
 # BRIEF: Enterprise firewall configuration — generates outbound allow-rules including SFTP deployment server
 # NOTE: Reads DEV_FTP_HOST / DEV_FTP_PORT variables to include SFTP egress rules alongside HTTPS rules.
 

.github/workflows/repository-cleanup.yml

@@ -8,37 +8,59 @@
 # DEFGROUP: GitHub.Workflow
 # INGROUP: MokoStandards.Maintenance
 # REPO: https://github.com/mokoconsulting-tech/MokoStandards
-# PATH: /templates/workflows/shared/repository-cleanup.yml
+# PATH: /templates/workflows/shared/repository-cleanup.yml.template
-# VERSION: 04.01.00
+# VERSION: 04.04.01
-# BRIEF: One-time repository cleanup — reset labels, strip issue template headers, delete old branches
+# BRIEF: Recurring repository maintenance — labels, branches, workflows, logs, doc indexes
 # NOTE: Synced via bulk-repo-sync to .github/workflows/repository-cleanup.yml in all governed repos.
-#       Run manually via workflow_dispatch. Safe to re-run — all operations are idempotent.
+#       Runs on the 1st and 15th of each month at 6:00 AM UTC, and on manual dispatch.
 
 name: Repository Cleanup
 
 on:
+  schedule:
+    - cron: '0 6 1,15 * *'
   workflow_dispatch:
     inputs:
       reset_labels:
-        description: 'Delete ALL existing labels and recreate the standard 54-label set'
+        description: 'Delete ALL existing labels and recreate the standard set'
+        type: boolean
+        default: false
+      clean_branches:
+        description: 'Delete old chore/sync-mokostandards-* branches'
         type: boolean
         default: true
-      clean_branches:
+      clean_workflows:
-        description: 'Delete old chore/sync-mokostandards-* branches (keeps current versioned branch only)'
+        description: 'Delete orphaned workflow runs (cancelled, stale)'
+        type: boolean
+        default: true
+      clean_logs:
+        description: 'Delete workflow run logs older than 30 days'
         type: boolean
         default: true
       fix_templates:
         description: 'Strip copyright comment blocks from issue templates'
         type: boolean
         default: true
+      rebuild_indexes:
+        description: 'Rebuild docs/ index files'
+        type: boolean
+        default: true
+      delete_closed_issues:
+        description: 'Delete issues that have been closed for more than 30 days'
+        type: boolean
+        default: false
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 permissions:
   contents: write
   issues: write
+  actions: write
 
 jobs:
   cleanup:
-    name: Repository Cleanup
+    name: Repository Maintenance
     runs-on: ubuntu-latest
 
     steps:
@@ -46,12 +68,18 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           token: ${{ secrets.GH_TOKEN || github.token }}
+          fetch-depth: 0
 
       - name: Check actor permission
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         run: |
           ACTOR="${{ github.actor }}"
+          # Schedule triggers use github-actions[bot]
+          if [ "${{ github.event_name }}" = "schedule" ]; then
+            echo "✅ Scheduled run — authorized"
+            exit 0
+          fi
           AUTHORIZED_USERS="jmiller-moko github-actions[bot]"
           for user in $AUTHORIZED_USERS; do
             if [ "$ACTOR" = "$user" ]; then
@@ -66,9 +94,92 @@ jobs:
             *) echo "❌ Admin or maintain required"; exit 1 ;;
           esac
 
+      # ── Determine which tasks to run ─────────────────────────────────────
+      # On schedule: run all tasks with safe defaults (labels NOT reset)
+      # On dispatch: use input toggles
+      - name: Set task flags
+        id: tasks
+        run: |
+          if [ "${{ github.event_name }}" = "schedule" ]; then
+            echo "reset_labels=false" >> $GITHUB_OUTPUT
+            echo "clean_branches=true" >> $GITHUB_OUTPUT
+            echo "clean_workflows=true" >> $GITHUB_OUTPUT
+            echo "clean_logs=true" >> $GITHUB_OUTPUT
+            echo "fix_templates=true" >> $GITHUB_OUTPUT
+            echo "rebuild_indexes=true" >> $GITHUB_OUTPUT
+            echo "delete_closed_issues=false" >> $GITHUB_OUTPUT
+          else
+            echo "reset_labels=${{ inputs.reset_labels }}" >> $GITHUB_OUTPUT
+            echo "clean_branches=${{ inputs.clean_branches }}" >> $GITHUB_OUTPUT
+            echo "clean_workflows=${{ inputs.clean_workflows }}" >> $GITHUB_OUTPUT
+            echo "clean_logs=${{ inputs.clean_logs }}" >> $GITHUB_OUTPUT
+            echo "fix_templates=${{ inputs.fix_templates }}" >> $GITHUB_OUTPUT
+            echo "rebuild_indexes=${{ inputs.rebuild_indexes }}" >> $GITHUB_OUTPUT
+            echo "delete_closed_issues=${{ inputs.delete_closed_issues }}" >> $GITHUB_OUTPUT
+          fi
+
+      # ── DELETE RETIRED WORKFLOWS (always runs) ────────────────────────────
+      - name: Delete retired workflow files
+        run: |
+          echo "## 🗑️ Retired Workflow Cleanup" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          RETIRED=(
+            ".github/workflows/build.yml"
+            ".github/workflows/code-quality.yml"
+            ".github/workflows/release-cycle.yml"
+            ".github/workflows/release-pipeline.yml"
+            ".github/workflows/branch-cleanup.yml"
+            ".github/workflows/auto-update-changelog.yml"
+            ".github/workflows/enterprise-issue-manager.yml"
+            ".github/workflows/flush-actions-cache.yml"
+            ".github/workflows/mokostandards-script-runner.yml"
+            ".github/workflows/unified-ci.yml"
+            ".github/workflows/unified-platform-testing.yml"
+            ".github/workflows/reusable-build.yml"
+            ".github/workflows/reusable-ci-validation.yml"
+            ".github/workflows/reusable-deploy.yml"
+            ".github/workflows/reusable-php-quality.yml"
+            ".github/workflows/reusable-platform-testing.yml"
+            ".github/workflows/reusable-project-detector.yml"
+            ".github/workflows/reusable-release.yml"
+            ".github/workflows/reusable-script-executor.yml"
+            ".github/workflows/rebuild-docs-indexes.yml"
+            ".github/workflows/setup-project-v2.yml"
+            ".github/workflows/sync-docs-to-project.yml"
+            ".github/workflows/release.yml"
+            ".github/workflows/sync-changelogs.yml"
+            ".github/workflows/version_branch.yml"
+            "update.json"
+            ".github/workflows/auto-version-branch.yml"
+            ".github/workflows/publish-to-mokodolibarr.yml"
+            ".github/workflows/ci.yml"
+          )
+
+          DELETED=0
+          for wf in "${RETIRED[@]}"; do
+            if [ -f "$wf" ]; then
+              git rm "$wf" 2>/dev/null || rm -f "$wf"
+              echo "  Deleted: \`$(basename $wf)\`" >> $GITHUB_STEP_SUMMARY
+              DELETED=$((DELETED+1))
+            fi
+          done
+
+          if [ "$DELETED" -gt 0 ]; then
+            git config --local user.email "github-actions[bot]@users.noreply.github.com"
+            git config --local user.name "github-actions[bot]"
+            git add -A
+            git commit -m "chore: delete ${DELETED} retired workflow file(s) [skip ci]" \
+              --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+            git push
+            echo "✅ ${DELETED} retired workflow(s) deleted" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "✅ No retired workflows found" >> $GITHUB_STEP_SUMMARY
+          fi
+
       # ── LABEL RESET ──────────────────────────────────────────────────────
       - name: Reset labels to standard set
-        if: inputs.reset_labels == true
+        if: steps.tasks.outputs.reset_labels == 'true'
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         run: |
@@ -76,23 +187,16 @@ jobs:
           echo "## 🏷️ Label Reset" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
-          # Delete all existing labels
-          echo "Deleting existing labels..."
-          DELETED=0
           gh api "repos/${REPO}/labels?per_page=100" --paginate --jq '.[].name' | while read -r label; do
             ENCODED=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$label', safe=''))")
-            gh api -X DELETE "repos/${REPO}/labels/${ENCODED}" --silent 2>/dev/null && DELETED=$((DELETED+1)) || true
+            gh api -X DELETE "repos/${REPO}/labels/${ENCODED}" --silent 2>/dev/null || true
           done
-          echo "Deleted existing labels" >> $GITHUB_STEP_SUMMARY
 
-          # Create the standard 54-label set
-          echo "Creating standard labels..."
-          CREATED=0
           while IFS='|' read -r name color description; do
             [ -z "$name" ] && continue
             gh api "repos/${REPO}/labels" \
               -f name="$name" -f color="$color" -f description="$description" \
-              --silent 2>/dev/null && CREATED=$((CREATED+1)) || true
+              --silent 2>/dev/null || true
           done << 'LABELS'
           joomla|7F52FF|Joomla extension or component
           dolibarr|FF6B6B|Dolibarr module or extension
@@ -125,6 +229,7 @@ jobs:
           type: enhancement|84B6EB|Enhancement to existing feature
           type: refactor|F9D0C4|Code refactoring
           type: chore|FEF2C0|Maintenance tasks
+          type: version|0E8A16|Version-related change
           status: pending|FBCA04|Pending action or decision
           status: in-progress|0E8A16|Currently being worked on
           status: blocked|B60205|Blocked by another issue or dependency
@@ -149,45 +254,85 @@ jobs:
           version-drift|FFA500|Version mismatch detected
           deploy-failure|CC0000|Automated deploy failure tracking
           template-validation-failure|D73A4A|Template workflow validation failure
+          version|0E8A16|Version bump or release
           LABELS
 
           echo "✅ Standard labels created" >> $GITHUB_STEP_SUMMARY
 
       # ── BRANCH CLEANUP ───────────────────────────────────────────────────
       - name: Delete old sync branches
-        if: inputs.clean_branches == true
+        if: steps.tasks.outputs.clean_branches == 'true'
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         run: |
           REPO="${{ github.repository }}"
-          CURRENT="chore/sync-mokostandards-v04.01.00"
+          CURRENT="chore/sync-mokostandards-v04.04"
           echo "## 🌿 Branch Cleanup" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
 
-          DELETED=0
+          FOUND=false
           gh api "repos/${REPO}/branches?per_page=100" --jq '.[].name' | \
             grep "^chore/sync-mokostandards" | \
             grep -v "^${CURRENT}$" | while read -r branch; do
-              # Close any open PRs on this branch
               gh pr list --repo "$REPO" --head "$branch" --state open --json number --jq '.[].number' 2>/dev/null | while read -r pr; do
                 gh pr close "$pr" --repo "$REPO" --comment "Superseded by \`${CURRENT}\`" 2>/dev/null || true
                 echo "  Closed PR #${pr}" >> $GITHUB_STEP_SUMMARY
               done
-              # Delete the branch
               gh api -X DELETE "repos/${REPO}/git/refs/heads/${branch}" --silent 2>/dev/null || true
               echo "  Deleted: \`${branch}\`" >> $GITHUB_STEP_SUMMARY
+              FOUND=true
+          done
+
+          if [ "$FOUND" != "true" ]; then
+            echo "✅ No old sync branches found" >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # ── WORKFLOW RUN CLEANUP ─────────────────────────────────────────────
+      - name: Clean up workflow runs
+        if: steps.tasks.outputs.clean_workflows == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
+        run: |
+          REPO="${{ github.repository }}"
+          echo "## 🔄 Workflow Run Cleanup" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          DELETED=0
+          # Delete cancelled and stale workflow runs
+          for status in cancelled stale; do
+            gh api "repos/${REPO}/actions/runs?status=${status}&per_page=100" \
+              --jq '.workflow_runs[].id' 2>/dev/null | while read -r run_id; do
+                gh api -X DELETE "repos/${REPO}/actions/runs/${run_id}" --silent 2>/dev/null || true
+                DELETED=$((DELETED+1))
+            done
+          done
+
+          echo "✅ Cleaned cancelled/stale workflow runs" >> $GITHUB_STEP_SUMMARY
+
+      # ── LOG CLEANUP ──────────────────────────────────────────────────────
+      - name: Delete old workflow run logs
+        if: steps.tasks.outputs.clean_logs == 'true'
+        env:
+          GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
+        run: |
+          REPO="${{ github.repository }}"
+          CUTOFF=$(date -u -d '30 days ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)
+          echo "## 📋 Log Cleanup" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Deleting logs older than: ${CUTOFF}" >> $GITHUB_STEP_SUMMARY
+
+          DELETED=0
+          gh api "repos/${REPO}/actions/runs?created=<${CUTOFF}&per_page=100" \
+            --jq '.workflow_runs[].id' 2>/dev/null | while read -r run_id; do
+              gh api -X DELETE "repos/${REPO}/actions/runs/${run_id}/logs" --silent 2>/dev/null || true
               DELETED=$((DELETED+1))
           done
 
-          if [ "$DELETED" -eq 0 ] 2>/dev/null; then
+          echo "✅ Cleaned old workflow run logs" >> $GITHUB_STEP_SUMMARY
-            echo "✅ No old sync branches found" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "✅ Cleanup complete" >> $GITHUB_STEP_SUMMARY
-          fi
 
       # ── ISSUE TEMPLATE FIX ──────────────────────────────────────────────
       - name: Strip copyright headers from issue templates
-        if: inputs.fix_templates == true
+        if: steps.tasks.outputs.fix_templates == 'true'
         run: |
           echo "## 📋 Issue Template Cleanup" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
@@ -214,26 +359,158 @@ jobs:
             echo "✅ No templates need cleaning" >> $GITHUB_STEP_SUMMARY
           fi
 
-      # ── SELF-DELETE ─────────────────────────────────────────────────────
+      # ── REBUILD DOC INDEXES ─────────────────────────────────────────────
-      - name: Delete this workflow (one-time use)
+      - name: Rebuild docs/ index files
-        if: success()
+        if: steps.tasks.outputs.rebuild_indexes == 'true'
+        run: |
+          echo "## 📚 Documentation Index Rebuild" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ ! -d "docs" ]; then
+            echo "⏭️ No docs/ directory — skipping" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+
+          UPDATED=0
+          # Generate index.md for each docs/ subdirectory
+          find docs -type d | while read -r dir; do
+            INDEX="${dir}/index.md"
+            FILES=$(find "$dir" -maxdepth 1 -name "*.md" ! -name "index.md" -printf "- [%f](./%f)\n" 2>/dev/null | sort)
+            if [ -z "$FILES" ]; then
+              continue
+            fi
+
+            cat > "$INDEX" << INDEXEOF
+            # $(basename "$dir")
+
+            ## Documents
+
+            ${FILES}
+
+            ---
+            *Auto-generated by repository-cleanup workflow*
+          INDEXEOF
+            # Dedent
+            sed -i 's/^            //' "$INDEX"
+            UPDATED=$((UPDATED+1))
+          done
+
+          if [ "$UPDATED" -gt 0 ]; then
+            git config --local user.email "github-actions[bot]@users.noreply.github.com"
+            git config --local user.name "github-actions[bot]"
+            git add docs/
+            if ! git diff --cached --quiet; then
+              git commit -m "docs: rebuild documentation indexes [skip ci]" \
+                --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+              git push
+              echo "✅ ${UPDATED} index file(s) rebuilt and committed" >> $GITHUB_STEP_SUMMARY
+            else
+              echo "✅ All indexes already up to date" >> $GITHUB_STEP_SUMMARY
+            fi
+          else
+            echo "✅ No indexes to rebuild" >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # ── VERSION DRIFT DETECTION ──────────────────────────────────────────
+      - name: Check for version drift
+        run: |
+          echo "## 📦 Version Drift Check" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ ! -f "README.md" ]; then
+            echo "⏭️ No README.md — skipping" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+
+          README_VERSION=$(grep -oP '^\s*VERSION:\s*\K[0-9]{2}\.[0-9]{2}\.[0-9]{2}' README.md 2>/dev/null | head -1)
+          if [ -z "$README_VERSION" ]; then
+            echo "⚠️ No VERSION found in README.md FILE INFORMATION block" >> $GITHUB_STEP_SUMMARY
+            exit 0
+          fi
+
+          echo "**README version:** \`${README_VERSION}\`" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          DRIFT=0
+          CHECKED=0
+
+          # Check all files with FILE INFORMATION blocks
+          while IFS= read -r -d '' file; do
+            FILE_VERSION=$(grep -oP '^\s*\*?\s*VERSION:\s*\K[0-9]{2}\.[0-9]{2}\.[0-9]{2}' "$file" 2>/dev/null | head -1)
+            [ -z "$FILE_VERSION" ] && continue
+            CHECKED=$((CHECKED+1))
+            if [ "$FILE_VERSION" != "$README_VERSION" ]; then
+              echo "  ⚠️ \`${file}\`: \`${FILE_VERSION}\` (expected \`${README_VERSION}\`)" >> $GITHUB_STEP_SUMMARY
+              DRIFT=$((DRIFT+1))
+            fi
+          done < <(find . -maxdepth 4 -type f \( -name "*.php" -o -name "*.md" -o -name "*.yml" \) ! -path "./.git/*" ! -path "./vendor/*" ! -path "./node_modules/*" -print0 2>/dev/null)
+
+          echo "" >> $GITHUB_STEP_SUMMARY
+          if [ "$DRIFT" -gt 0 ]; then
+            echo "⚠️ **${DRIFT}** file(s) out of ${CHECKED} have version drift" >> $GITHUB_STEP_SUMMARY
+            echo "Run \`sync-version-on-merge\` workflow or update manually" >> $GITHUB_STEP_SUMMARY
+          else
+            echo "✅ All ${CHECKED} file(s) match README version \`${README_VERSION}\`" >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # ── PROTECT CUSTOM WORKFLOWS ────────────────────────────────────────
+      - name: Ensure custom workflow directory exists
+        run: |
+          echo "## 🔧 Custom Workflows" >> $GITHUB_STEP_SUMMARY
+          echo "" >> $GITHUB_STEP_SUMMARY
+
+          if [ ! -d ".github/workflows/custom" ]; then
+            mkdir -p .github/workflows/custom
+            cat > .github/workflows/custom/README.md << 'CWEOF'
+          # Custom Workflows
+
+          Place repo-specific workflows here. Files in this directory are:
+          - **Never overwritten** by MokoStandards bulk sync
+          - **Never deleted** by the repository-cleanup workflow
+          - Safe for custom CI, notifications, or repo-specific automation
+
+          Synced workflows live in `.github/workflows/` (parent directory).
+          CWEOF
+            sed -i 's/^          //' .github/workflows/custom/README.md
+            git config --local user.email "github-actions[bot]@users.noreply.github.com"
+            git config --local user.name "github-actions[bot]"
+            git add .github/workflows/custom/
+            if ! git diff --cached --quiet; then
+              git commit -m "chore: create .github/workflows/custom/ for repo-specific workflows [skip ci]" \
+                --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+              git push
+              echo "✅ Created \`.github/workflows/custom/\` directory" >> $GITHUB_STEP_SUMMARY
+            fi
+          else
+            CUSTOM_COUNT=$(find .github/workflows/custom -name "*.yml" -o -name "*.yaml" 2>/dev/null | wc -l)
+            echo "✅ Custom workflow directory exists (${CUSTOM_COUNT} workflow(s))" >> $GITHUB_STEP_SUMMARY
+          fi
+
+      # ── DELETE CLOSED ISSUES ──────────────────────────────────────────────
+      - name: Delete old closed issues
+        if: steps.tasks.outputs.delete_closed_issues == 'true'
         env:
           GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
         run: |
-          echo "## 🗑️ Self-Cleanup" >> $GITHUB_STEP_SUMMARY
+          REPO="${{ github.repository }}"
+          CUTOFF=$(date -u -d '30 days ago' +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || date -u -v-30d +%Y-%m-%dT%H:%M:%SZ)
+          echo "## 🗑️ Closed Issue Cleanup" >> $GITHUB_STEP_SUMMARY
           echo "" >> $GITHUB_STEP_SUMMARY
+          echo "Deleting issues closed before: ${CUTOFF}" >> $GITHUB_STEP_SUMMARY
 
-          WORKFLOW_FILE=".github/workflows/repository-cleanup.yml"
+          DELETED=0
-          if [ -f "$WORKFLOW_FILE" ]; then
+          gh api "repos/${REPO}/issues?state=closed&since=1970-01-01T00:00:00Z&per_page=100&sort=updated&direction=asc" \
-            git config --local user.email "github-actions[bot]@users.noreply.github.com"
+            --jq ".[] | select(.closed_at < \"${CUTOFF}\") | .number" 2>/dev/null | while read -r num; do
-            git config --local user.name "github-actions[bot]"
+              # Lock and close with "not_planned" to mark as cleaned up
-            git rm "$WORKFLOW_FILE"
+              gh api "repos/${REPO}/issues/${num}/lock" -X PUT -f lock_reason="resolved" --silent 2>/dev/null || true
-            git commit -m "chore: remove repository-cleanup.yml after successful run [skip ci]" \
+              echo "  Locked issue #${num}" >> $GITHUB_STEP_SUMMARY
-              --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
+              DELETED=$((DELETED+1))
-            git push
+          done
-            echo "✅ Workflow file deleted — it will not appear in future syncs" >> $GITHUB_STEP_SUMMARY
+
+          if [ "$DELETED" -eq 0 ] 2>/dev/null; then
+            echo "✅ No old closed issues found" >> $GITHUB_STEP_SUMMARY
           else
-            echo "ℹ️ Workflow file already removed" >> $GITHUB_STEP_SUMMARY
+            echo "✅ Locked ${DELETED} old closed issue(s)" >> $GITHUB_STEP_SUMMARY
           fi
 
       - name: Summary
@@ -241,4 +518,4 @@ jobs:
         run: |
           echo "" >> $GITHUB_STEP_SUMMARY
           echo "---" >> $GITHUB_STEP_SUMMARY
-          echo "*Run by @${{ github.actor }} via workflow_dispatch*" >> $GITHUB_STEP_SUMMARY
+          echo "*Run by @${{ github.actor }} — trigger: ${{ github.event_name }}*" >> $GITHUB_STEP_SUMMARY

.github/workflows/sync-version-on-merge.yml

@@ -8,8 +8,8 @@
 # DEFGROUP: GitHub.Workflow
 # INGROUP: MokoStandards.Automation
 # REPO: https://github.com/mokoconsulting-tech/MokoStandards
-# PATH: /templates/workflows/shared/sync-version-on-merge.yml
+# PATH: /templates/workflows/shared/sync-version-on-merge.yml.template
-# VERSION: 04.01.00
+# VERSION: 04.04.01
 # BRIEF: Auto-bump patch version on every push to main and propagate to all file headers
 # NOTE: Synced via bulk-repo-sync to .github/workflows/sync-version-on-merge.yml in all governed repos.
 #       README.md is the single source of truth for the repository version.
@@ -32,6 +32,9 @@ permissions:
   contents: write
   issues: write
 
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
 jobs:
   sync-version:
     name: Propagate README version
@@ -45,7 +48,7 @@ jobs:
           fetch-depth: 0
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.31.0
+        uses: shivammathur/setup-php@fcafdd6392932010c2bd5094439b8e33be2a8a09 # v2.37.0
         with:
           php-version: '8.1'
           tools: composer
@@ -55,7 +58,7 @@ jobs:
           GH_TOKEN: ${{ secrets.GH_TOKEN || github.token }}
           COMPOSER_AUTH: '{"github-oauth":{"github.com":"${{ secrets.GH_TOKEN || github.token }}"}}'
         run: |
-          git clone --depth 1 --quiet \
+          git clone --depth 1 --branch version/04.04 --quiet \
             "https://x-access-token:${GH_TOKEN}@github.com/mokoconsulting-tech/MokoStandards.git" \
             /tmp/mokostandards
           cd /tmp/mokostandards
@@ -64,31 +67,20 @@ jobs:
       - name: Auto-bump patch version
         if: ${{ github.event_name == 'push' && github.actor != 'github-actions[bot]' }}
         run: |
-          # If README.md was part of this push, the author already bumped the version — skip.
           if git diff --name-only HEAD~1 HEAD 2>/dev/null | grep -q '^README\.md$'; then
             echo "README.md changed in this push — skipping auto-bump"
             exit 0
           fi
 
-          CURRENT=$(grep -oP '^\s*VERSION:\s*\K[0-9]{2}\.[0-9]{2}\.[0-9]{2}' README.md | head -1)
+          RESULT=$(php /tmp/mokostandards/api/cli/version_bump.php --path .) || {
-          if [ -z "$CURRENT" ]; then
+            echo "⚠️ Could not bump version — skipping"
-            echo "⚠️ No VERSION found in README.md — skipping auto-bump"
             exit 0
-          fi
+          }
-
+          echo "Auto-bumping patch: $RESULT"
-          # Increment the patch component (zero-padded to 2 digits)
-          MAJOR=$(echo "$CURRENT" | cut -d. -f1)
-          MINOR=$(echo "$CURRENT" | cut -d. -f2)
-          PATCH=$(echo "$CURRENT" | cut -d. -f3)
-          NEW_PATCH=$(printf '%02d' $(( 10#$PATCH + 1 )))
-          NEW_VERSION="${MAJOR}.${MINOR}.${NEW_PATCH}"
-
-          echo "Auto-bumping patch: $CURRENT → $NEW_VERSION"
-          sed -i "s/^\(\s*VERSION:\s*\)${CURRENT}/\1${NEW_VERSION}/" README.md
           git config --local user.email "github-actions[bot]@users.noreply.github.com"
           git config --local user.name "github-actions[bot]"
           git add README.md
-          git commit -m "chore(version): auto-bump patch ${CURRENT} → ${NEW_VERSION} [skip ci]" \
+          git commit -m "chore(version): auto-bump patch ${RESULT} [skip ci]" \
             --author="github-actions[bot] <github-actions[bot]@users.noreply.github.com>"
           git push
 
@@ -96,7 +88,7 @@ jobs:
         id: readme_version
         run: |
           git pull --ff-only 2>/dev/null || true
-          VERSION=$(grep -oP '^\s*VERSION:\s*\K[0-9]{2}\.[0-9]{2}\.[0-9]{2}' README.md | head -1)
+          VERSION=$(php /tmp/mokostandards/api/cli/version_read.php --path . 2>/dev/null)
           if [ -z "$VERSION" ]; then
             echo "⚠️ No VERSION in README.md — skipping propagation"
             echo "skip=true" >> $GITHUB_OUTPUT
@@ -119,8 +111,9 @@ jobs:
       - name: Commit updated files
         if: ${{ steps.readme_version.outputs.skip != 'true' && inputs.dry_run != true }}
         run: |
+          git pull --ff-only 2>/dev/null || true
           if git diff --quiet; then
-            echo "ℹ️ No version changes needed"
+            echo "ℹ️ No version changes needed — already up to date"
             exit 0
           fi
           VERSION="${{ steps.readme_version.outputs.version }}"