chore: sync .mokogitea/workflows/cascade-dev.yml from moko-platform [skip ci]

Authored-by: Moko Consulting
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.mokogitea/workflows/auto-release.yml

@@ -150,215 +150,10 @@ jobs:
           composer install --no-dev --no-interaction --quiet
 
 
-      # -- PLATFORM DETECTION ---------------------------------------------------
-      - name: Detect platform
-        id: platform
-        run: |
-          php /tmp/moko-platform-api/cli/manifest_read.php --path . --github-output
-          MANIFEST=$(find . -maxdepth 3 -name "*.xml" ! -path "./.git/*" -exec grep -l '<extension' {} \; 2>/dev/null | head -1 || true)
-          MOD_FILE=$(find . -maxdepth 4 -name "mod*.class.php" ! -path "./.git/*" -exec grep -l 'extends DolibarrModules' {} \; 2>/dev/null | head -1 || true)
-          echo "manifest=${MANIFEST}" >> "$GITHUB_OUTPUT"
-          echo "mod_file=${MOD_FILE}" >> "$GITHUB_OUTPUT"
-
-      - name: "Step 1: Read version"
-        id: version
-        run: |
-          VERSION=$(php /tmp/moko-platform-api/cli/version_read.php --path .)
-          if [ -z "$VERSION" ]; then
-            echo "::error::No VERSION in README.md"
-            echo "skip=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          # version_set_platform strips suffixes internally when --stability stable
-          MAJOR=$(echo "$VERSION" | cut -d. -f1 | sed 's/-.*//')
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "release_tag=stable" >> "$GITHUB_OUTPUT"
-          echo "skip=false" >> "$GITHUB_OUTPUT"
-          echo "branch=main" >> "$GITHUB_OUTPUT"
-
-      # -- CHECK FOR RC PROMOTION ------------------------------------------------
-      - name: "Check for RC release"
-        id: rc
-        if: steps.version.outputs.skip != 'true'
-        run: |
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          RC_JSON=$(curl -sf -H "Authorization: token ${{ secrets.MOKOGITEA_TOKEN }}" \
-            "${API_BASE}/releases/tags/release-candidate" 2>/dev/null || echo "{}")
-          RC_ID=$(echo "$RC_JSON" | php -r "\$d=json_decode(file_get_contents('php://stdin'),true); echo \$d['id'] ?? '';" 2>/dev/null || true)
-
-          if [ -n "$RC_ID" ] && [ "$RC_ID" != "None" ] && [ "$RC_ID" != "" ]; then
-            echo "promote=true" >> "$GITHUB_OUTPUT"
-            echo "release_id=${RC_ID}" >> "$GITHUB_OUTPUT"
-            echo "::notice::RC release found (id: ${RC_ID}) — will promote to stable"
-          else
-            echo "promote=false" >> "$GITHUB_OUTPUT"
-            echo "::notice::No RC release — full build pipeline"
-          fi
-
-      - name: "Step 1b: Minor bump version"
-        id: bump
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          steps.rc.outputs.promote != 'true'
-        run: |
-          MOKO_API="/tmp/moko-platform-api/cli"
-          php ${MOKO_API}/version_bump.php --path . --minor 2>&1 || true
-          VERSION=$(php ${MOKO_API}/version_read.php --path .)
-          # version_set_platform handles suffix stripping — just pass clean base version
-          echo "version=${VERSION}" >> "$GITHUB_OUTPUT"
-          echo "Bumped to: ${VERSION}"
-
-      - name: Check if already released
-        if: steps.version.outputs.skip != 'true'
-        id: check
-        run: |
-          TAG="${{ steps.version.outputs.release_tag }}"
-          BRANCH="${{ steps.version.outputs.branch }}"
-
-          TAG_EXISTS=false
-          BRANCH_EXISTS=false
-
-          git rev-parse "$TAG" >/dev/null 2>&1 && TAG_EXISTS=true
-          git ls-remote --heads origin "$BRANCH" 2>/dev/null | grep -q "$BRANCH" && BRANCH_EXISTS=true
-
-          echo "tag_exists=$TAG_EXISTS" >> "$GITHUB_OUTPUT"
-          echo "branch_exists=$BRANCH_EXISTS" >> "$GITHUB_OUTPUT"
-
-          # Tag and branch may persist across patch releases — never skip
-          echo "already_released=false" >> "$GITHUB_OUTPUT"
-
-      # -- SANITY CHECKS -------------------------------------------------------
-      - name: "Sanity: Pre-release validation"
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          steps.check.outputs.already_released != 'true'
-        run: |
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          php /tmp/moko-platform-api/cli/release_validate.php \
-            --path . --version "$VERSION" --output-summary --github-output || true
-
-      # -- STEP 2: Create or update version/XX.YY archive branch ---------------
-      # Always runs — every version change on main archives to version/XX.YY
-      - name: "Step 2: Version archive branch"
-        if: steps.check.outputs.already_released != 'true'
-        run: |
-          BRANCH="${{ steps.version.outputs.branch }}"
-          IS_MINOR="${{ steps.version.outputs.is_minor }}"
-          PATCH="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          PATCH_NUM=$(echo "$PATCH" | awk -F. '{print $3}')
-
-          # Check if branch exists
-          if git ls-remote --heads origin "$BRANCH" | grep -q "$BRANCH"; then
-            git push origin HEAD:"$BRANCH" --force
-            echo "Updated archive branch: ${BRANCH} (patch ${PATCH_NUM})" >> $GITHUB_STEP_SUMMARY
-          else
-            git checkout -b "$BRANCH" 2>/dev/null || git checkout "$BRANCH"
-            git push origin "$BRANCH" --force
-            echo "Created archive branch: ${BRANCH}" >> $GITHUB_STEP_SUMMARY
-          fi
-
-      # -- STEP 3: Set platform version ----------------------------------------
-      - name: "Step 3: Set platform version"
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          steps.check.outputs.already_released != 'true'
-        run: |
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          php /tmp/moko-platform-api/cli/version_set_platform.php \
-            --path . --version "$VERSION" --branch main
-
-      # -- STEP 4: Update version badges ----------------------------------------
-      - name: "Step 4: Update version badges"
-        if: steps.version.outputs.skip != 'true'
-        run: |
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          php /tmp/moko-platform-api/cli/badge_update.php --path . --version "${VERSION}" 2>/dev/null || true
-          php /tmp/moko-platform-api/cli/version_check.php --path . --fix 2>/dev/null || true
-
-      # Step 5 (updates.xml) moved after Step 8 to include SHA-256 checksum
-
-      - name: "Step 4b: Promote and prune CHANGELOG"
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          steps.check.outputs.already_released != 'true'
-        run: |
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          MOKO_API="/tmp/moko-platform-api/cli"
-          if [ -f "CHANGELOG.md" ]; then
-            php ${MOKO_API}/changelog_promote.php --path . --version "$VERSION" 2>&1 || true
-            php ${MOKO_API}/changelog_prune.php --path . --keep 5 2>&1 || true
-          fi
-
-      - name: Commit release changes
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          steps.check.outputs.already_released != 'true'
-        run: |
-          if git diff --quiet && git diff --cached --quiet; then
-            echo "No changes to commit"
-            exit 0
-          fi
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          git add -A
-          git commit -m "chore(release): build ${VERSION} [skip ci]" \
-            --author="gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>"
-          # Detached HEAD on PR merge — push explicitly to main
-          git push origin HEAD:refs/heads/main
-
-      # -- STEP 6: Create tag ---------------------------------------------------
-      - name: "Step 6: Create git tag"
-        if: >-
-          steps.version.outputs.skip != 'true'
-        run: |
-          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
-          # Only create the major release tag if it doesn't exist yet
-          if ! git rev-parse "$RELEASE_TAG" >/dev/null 2>&1; then
-            git tag "$RELEASE_TAG"
-            git push origin "$RELEASE_TAG"
-            echo "Tag created: ${RELEASE_TAG}" >> $GITHUB_STEP_SUMMARY
-          else
-            echo "Tag ${RELEASE_TAG} already exists" >> $GITHUB_STEP_SUMMARY
-          fi
-          echo "Tag: ${TAG}" >> $GITHUB_STEP_SUMMARY
-
-      # -- STEP 7a: Promote RC to stable (skip build) ----------------------------
-      - name: "Step 7a: Promote RC to stable"
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          steps.rc.outputs.promote == 'true'
-        run: |
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          php /tmp/moko-platform-api/cli/release_promote.php \
-            --from release-candidate --to stable \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" \
-            --api-base "${API_BASE}" \
-            --path . --branch main
-          echo "Promoted RC → stable (${VERSION})" >> $GITHUB_STEP_SUMMARY
-
-      # -- STEP 7b: Create or update Gitea Release (full build path) -------------
-      - name: "Step 7b: Gitea Release"
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          steps.rc.outputs.promote != 'true'
-        run: |
-          VERSION="${{ steps.bump.outputs.version || steps.version.outputs.version }}"
-          RELEASE_TAG="${{ steps.version.outputs.release_tag }}"
-          API_BASE="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          php /tmp/moko-platform-api/cli/release_create.php \
-            --path . --version "$VERSION" --tag "$RELEASE_TAG" \
-            --token "${{ secrets.MOKOGITEA_TOKEN }}" --api-base "$API_BASE" \
-            --repo "${GITEA_REPO}" --branch main
-          echo "Release created: ${VERSION}" >> $GITHUB_STEP_SUMMARY
-
-      # -- STEP 8: Build packages and upload to release ----------------------------
-      - name: "Publish stable release (+ copies for all lesser streams)"
-        if: >-
-          steps.version.outputs.skip != 'true' &&
-          steps.rc.outputs.promote != 'true'
+      - name: "Publish stable release"
         run: |
           php /tmp/moko-platform-api/cli/release_publish.php \
-            --path . --stability stable --branch main \
+            --path . --stability stable --bump minor --branch main \
             --token "${{ secrets.MOKOGITEA_TOKEN }}"
 
       # -- STEP 9: Mirror to GitHub (stable only) --------------------------------

.mokogitea/workflows/cascade-dev.yml

@@ -1,213 +1,10 @@
-# Copyright (C) 2026 Moko Consulting <hello@mokoconsulting.tech>
-#
-# SPDX-License-Identifier: GPL-3.0-or-later
-#
-# FILE INFORMATION
-# DEFGROUP: Gitea.Workflow
-# INGROUP: moko-platform.Maintenance
-# REPO: https://git.mokoconsulting.tech/mokoconsulting-tech/moko-platform
-# PATH: /templates/workflows/cascade-dev.yml.template
-# VERSION: 02.00.00
-# BRIEF: Forward-merge main → all open branches after every push to main
-#
-# +========================================================================+
-# |                CASCADE MAIN → ALL BRANCHES                             |
-# +========================================================================+
-# |                                                                        |
-# |  Triggers on every push to main (PR merges, bot commits, etc.)         |
-# |                                                                        |
-# |  1. List all branches matching: dev, rc/*, beta/*, alpha/*             |
-# |  2. For each: create PR (main → branch), auto-merge if clean           |
-# |  3. On conflict: leave PR open for manual resolution                   |
-# |                                                                        |
-# +========================================================================+
-
-name: "Universal: Cascade Main → Dev"
-
-on:
-  push:
-    branches:
-      - main
-  workflow_dispatch:
-
-env:
-  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
-  GITEA_URL: ${{ vars.GITEA_URL || 'https://git.mokoconsulting.tech' }}
-  GITEA_ORG: ${{ vars.GITEA_ORG || github.repository_owner }}
-  GITEA_REPO: ${{ vars.GITEA_REPO || github.event.repository.name }}
-
-permissions:
-  contents: write
-  pull-requests: write
-
+# DISABLED — auto-release Step 11 recreates dev from main after every release.
+# Cascade-dev is redundant and causes version conflicts when both main and dev
+# have different version numbers in templateDetails.xml / manifest.xml.
+name: "Cascade Main → Dev (DISABLED)"
+on: workflow_dispatch
 jobs:
-  cascade:
-    name: Cascade main → branches
+  noop:
     runs-on: ubuntu-latest
-    if: >-
-      !contains(github.event.head_commit.message, '[skip ci]') &&
-      !contains(github.event.head_commit.message, '[skip cascade]')
-
     steps:
-      - name: Discover target branches
-        id: branches
-        env:
-          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          API="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-
-          # Fetch all branches (paginated)
-          PAGE=1
-          ALL_BRANCHES=""
-          while true; do
-            BATCH=$(curl -sS \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              "${API}/branches?page=${PAGE}&limit=50" \
-              | jq -r '.[].name // empty')
-            [ -z "$BATCH" ] && break
-            ALL_BRANCHES="$ALL_BRANCHES $BATCH"
-            PAGE=$((PAGE + 1))
-          done
-
-          # Filter to cascade targets: dev, dev/*, rc/*, beta/*, alpha/*
-          TARGETS=""
-          for BRANCH in $ALL_BRANCHES; do
-            case "$BRANCH" in
-              dev|dev/*|rc/*|beta/*|alpha/*)
-                TARGETS="$TARGETS $BRANCH"
-                ;;
-            esac
-          done
-
-          TARGETS=$(echo "$TARGETS" | xargs)  # trim whitespace
-
-          if [ -z "$TARGETS" ]; then
-            echo "targets=" >> "$GITHUB_OUTPUT"
-            echo "ℹ️  No cascade target branches found"
-          else
-            echo "targets=$TARGETS" >> "$GITHUB_OUTPUT"
-            COUNT=$(echo "$TARGETS" | wc -w)
-            echo "📋 Found ${COUNT} target branch(es): ${TARGETS}"
-          fi
-
-      - name: Cascade to all target branches
-        if: steps.branches.outputs.targets != ''
-        env:
-          GA_TOKEN: ${{ secrets.MOKOGITEA_TOKEN }}
-        run: |
-          API="${GITEA_URL}/api/v1/repos/${GITEA_ORG}/${GITEA_REPO}"
-          SHORT_SHA="${GITHUB_SHA:0:7}"
-          TARGETS="${{ steps.branches.outputs.targets }}"
-
-          SUCCESS=0
-          CONFLICTS=0
-          SKIPPED=0
-          FAILED=0
-
-          for BRANCH in $TARGETS; do
-            echo ""
-            echo "═══ main → ${BRANCH} ═══"
-
-            # Check if branch is already up to date
-            ENCODED_BRANCH=$(echo "$BRANCH" | sed 's|/|%2F|g')
-            RESPONSE=$(curl -sS \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              "${API}/compare/${ENCODED_BRANCH}...main")
-
-            AHEAD=$(echo "$RESPONSE" | jq '.total_commits // 0')
-
-            if [ "$AHEAD" -eq 0 ]; then
-              echo "  ✅ Already up to date"
-              SKIPPED=$((SKIPPED + 1))
-              continue
-            fi
-
-            echo "  ℹ️  main is ${AHEAD} commit(s) ahead"
-
-            # Check for existing cascade PR
-            EXISTING=$(curl -sS \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              "${API}/pulls?state=open&head=${GITEA_ORG}:main&base=${ENCODED_BRANCH}&limit=1")
-
-            EXISTING_COUNT=$(echo "$EXISTING" | jq 'length')
-            PR_NUMBER=""
-
-            if [ "$EXISTING_COUNT" -gt 0 ]; then
-              PR_NUMBER=$(echo "$EXISTING" | jq -r '.[0].number')
-              echo "  ℹ️  Reusing existing PR #${PR_NUMBER}"
-            else
-              # Create cascade PR
-              PR_RESPONSE=$(curl -sS -w "\n%{http_code}" \
-                -X POST \
-                -H "Authorization: token ${GITEA_TOKEN}" \
-                -H "Content-Type: application/json" \
-                -d "{
-                  \"title\": \"chore: cascade main → ${BRANCH} (${SHORT_SHA}) [skip ci]\",
-                  \"body\": \"## Automatic cascade\\n\\nForward-merging \`main\` (${SHORT_SHA}) into \`${BRANCH}\`.\\n\\nIf conflicts exist, resolve manually and merge.\\n\\n> Auto-created by **Cascade Main → Dev**.\",
-                  \"head\": \"main\",
-                  \"base\": \"${BRANCH}\"
-                }" \
-                "${API}/pulls")
-
-              HTTP_CODE=$(echo "$PR_RESPONSE" | tail -1)
-              BODY=$(echo "$PR_RESPONSE" | sed '$d')
-              PR_NUMBER=$(echo "$BODY" | jq -r '.number // empty')
-
-              if [ "$HTTP_CODE" != "201" ] || [ -z "$PR_NUMBER" ]; then
-                MSG=$(echo "$BODY" | jq -r '.message // .' 2>/dev/null | head -1)
-                echo "  ❌ Failed to create PR (HTTP ${HTTP_CODE}): ${MSG}"
-                FAILED=$((FAILED + 1))
-                continue
-              fi
-
-              echo "  ✅ Created PR #${PR_NUMBER}"
-            fi
-
-            # Try auto-merge
-            PR_DATA=$(curl -sS \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              "${API}/pulls/${PR_NUMBER}")
-
-            MERGEABLE=$(echo "$PR_DATA" | jq -r '.mergeable // false')
-
-            if [ "$MERGEABLE" != "true" ]; then
-              echo "  ⚠️  Conflicts — PR #${PR_NUMBER} left open"
-              CONFLICTS=$((CONFLICTS + 1))
-              continue
-            fi
-
-            MERGE_RESPONSE=$(curl -sS -w "\n%{http_code}" \
-              -X POST \
-              -H "Authorization: token ${GITEA_TOKEN}" \
-              -H "Content-Type: application/json" \
-              -d "{
-                \"Do\": \"merge\",
-                \"merge_message_field\": \"chore: cascade main → ${BRANCH} [skip ci]\",
-                \"delete_branch_after_merge\": false
-              }" \
-              "${API}/pulls/${PR_NUMBER}/merge")
-
-            MERGE_HTTP=$(echo "$MERGE_RESPONSE" | tail -1)
-
-            if [ "$MERGE_HTTP" = "200" ] || [ "$MERGE_HTTP" = "204" ]; then
-              echo "  ✅ Merged — ${BRANCH} is in sync"
-              SUCCESS=$((SUCCESS + 1))
-            else
-              MERGE_BODY=$(echo "$MERGE_RESPONSE" | sed '$d')
-              echo "  ⚠️  Merge failed (HTTP ${MERGE_HTTP}) — PR #${PR_NUMBER} left open"
-              CONFLICTS=$((CONFLICTS + 1))
-            fi
-          done
-
-          # Summary
-          echo ""
-          echo "════════════════════════════════════════"
-          echo "  ✅ Merged:    ${SUCCESS}"
-          echo "  ⚠️  Conflicts: ${CONFLICTS}"
-          echo "  ⏭️  Up to date: ${SKIPPED}"
-          echo "  ❌ Failed:    ${FAILED}"
-          echo "════════════════════════════════════════"
-
-          if [ "$FAILED" -gt 0 ]; then
-            exit 1
-          fi
+      - run: echo "Cascade disabled — auto-release handles dev recreation"

.mokogitea/workflows/issue-branch.yml

@@ -5,7 +5,7 @@
 # FILE INFORMATION
 # DEFGROUP: Gitea.Workflow
 # INGROUP: moko-platform.Automation
-# VERSION: 09.10.00
+# VERSION: 09.21.00
 # BRIEF: Auto-create feature branch when an issue is opened
 
 name: "Universal: Issue Branch"

.mokogitea/workflows/pr-check.yml

@@ -52,22 +52,22 @@ jobs:
                 REASON="Fix branches must target 'dev', not '${BASE}'"
               fi
               ;;
+            patch/*)
+              if [ "$BASE" != "dev" ] && [ "$BASE" != "rc" ]; then
+                ALLOWED=false
+                REASON="Patch branches must target 'dev' or 'rc', not '${BASE}'"
+              fi
+              ;;
             hotfix/*)
               if [ "$BASE" != "dev" ] && [ "$BASE" != "main" ]; then
                 ALLOWED=false
                 REASON="Hotfix branches can only target 'dev' or 'main', not '${BASE}'"
               fi
               ;;
-            alpha/*|beta/*)
-              if [ "$BASE" != "dev" ]; then
-                ALLOWED=false
-                REASON="Pre-release branches must target 'dev', not '${BASE}'"
-              fi
-              ;;
-            rc/*)
+            rc)
               if [ "$BASE" != "main" ]; then
                 ALLOWED=false
-                REASON="Release candidate branches must target 'main', not '${BASE}'"
+                REASON="RC branch can only merge into 'main', not '${BASE}'"
               fi
               ;;
             dev)
@@ -183,6 +183,28 @@ jobs:
               ;;
           esac
 
+      - name: Check changelog has unreleased entry
+        run: |
+          if [ ! -f "CHANGELOG.md" ]; then
+            echo "::warning::No CHANGELOG.md found"
+            exit 0
+          fi
+          # Check for content under [Unreleased] section
+          if ! grep -q "## \[Unreleased\]" CHANGELOG.md; then
+            echo "::error::CHANGELOG.md missing [Unreleased] section"
+            exit 1
+          fi
+          # Check there's at least one entry (Added/Changed/Fixed/Removed) under Unreleased
+          UNRELEASED_CONTENT=$(sed -n '/## \[Unreleased\]/,/## \[/p' CHANGELOG.md | grep -cE '^\s*-\s' || true)
+          if [ "$UNRELEASED_CONTENT" -eq 0 ]; then
+            echo "::error::CHANGELOG.md [Unreleased] section has no entries. Add a changelog entry describing your changes."
+            echo "## Changelog Check: Failed" >> $GITHUB_STEP_SUMMARY
+            echo "The \`[Unreleased]\` section in CHANGELOG.md has no entries." >> $GITHUB_STEP_SUMMARY
+            echo "Add a line like \`- Description of your change\` under a heading (\`### Added\`, \`### Changed\`, \`### Fixed\`, etc.)" >> $GITHUB_STEP_SUMMARY
+            exit 1
+          fi
+          echo "Changelog: ${UNRELEASED_CONTENT} entry/entries in [Unreleased]"
+
       - name: Verify package source
         run: |
           SOURCE_DIR="src"

CHANGELOG.md

@@ -12,12 +12,12 @@ BRIEF: Release changelog
 # Changelog
 ## [Unreleased]
 
-## [09.10.00] --- 2026-05-30
+## [09.21.00] --- 2026-05-30
 
-## [09.10.00] --- 2026-05-30
+## [09.20.00] --- 2026-05-30
 
-## [09.10.00] --- 2026-05-30
+## [09.19.00] --- 2026-05-30
 
-## [09.09.00] --- 2026-05-30
+## [09.18.00] --- 2026-05-30
 
-## [09.09.00] --- 2026-05-29
+## [09.17.00] --- 2026-05-30

README.md

@@ -6,7 +6,7 @@ DEFGROUP: MokoStandards.Root
 INGROUP: MokoStandards
 REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
 PATH: /README.md
-VERSION: 09.10.00
+VERSION: 09.21.00
 BRIEF: Project overview and documentation
 -->
 

cli/branch_rename.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/branch_rename.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Rename a git branch via Gitea API (create new, update PR, delete old)
  *
  * Usage:

cli/bulk_workflow_push.php

@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/bulk_workflow_push.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Push a workflow file to all governed repos via the Gitea Contents API
  */
 

cli/bulk_workflow_trigger.php

@@ -11,7 +11,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/bulk_workflow_trigger.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Trigger a workflow across multiple repos at once
  */
 

cli/client_dashboard.php

@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/client_dashboard.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Generate unified client dashboard HTML
  */
 

cli/client_inventory.php

@@ -11,7 +11,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/client_inventory.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Discover and list all client-waas repos with their server configuration status
  */
 

cli/client_provision.php

@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/client_provision.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Provision a new client environment end-to-end
  */
 

cli/grafana_dashboard.php

@@ -12,7 +12,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/grafana_dashboard.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Manage Grafana dashboards via API
  */
 

cli/joomla_build.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/joomla_build.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Build a Joomla extension ZIP from manifest — all types supported
  * NOTE: Called by pre-release and auto-release workflows.
  *

cli/manifest_read.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/manifest_read.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Parse .manifest.xml and output requested field(s) for CI consumption
  *
  * Usage:
@@ -93,6 +93,7 @@ if ($xml === false) {
     // Register namespace for XPath (optional, simple path works without)
     $fields = [
         'name'              => (string)($xml->identity->name ?? ''),
+        'display-name'      => (string)($xml->identity->{"display-name"} ?? ''),
         'org'               => (string)($xml->identity->org ?? ''),
         'description'       => (string)($xml->identity->description ?? ''),
         'license'           => (string)($xml->identity->license ?? ''),

cli/release_cascade.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/release_cascade.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: DEPRECATED — cascade behavior removed. Each release stream is independent.
  */
 

cli/release_create.php

@@ -135,13 +135,22 @@ $extFolder = '';
 $extName = '';
 $typePrefix = '';
 
-// Detect platform from manifest.xml
+// Detect platform and display name from manifest.xml
 $platform = 'generic';
+$prettyName = '';
 $manifestXml = "{$root}/.mokogitea/manifest.xml";
 if (file_exists($manifestXml)) {
     $content = file_get_contents($manifestXml);
-    if ($content !== false && preg_match('/<platform>([^<]+)<\/platform>/', $content, $pm)) {
-        $platform = trim($pm[1]);
+    if ($content !== false) {
+        if (preg_match('/<platform>([^<]+)<\/platform>/', $content, $pm)) {
+            $platform = trim($pm[1]);
+        }
+        // <display-name> is the human-friendly name; <name> is the element/repo name
+        if (preg_match('/<display-name>([^<]+)<\/display-name>/', $content, $dn)) {
+            $prettyName = trim($dn[1]);
+        } elseif (preg_match('/<name>([^<]+)<\/name>/', $content, $nm)) {
+            $prettyName = trim($nm[1]);
+        }
     }
 }
 
@@ -263,8 +272,9 @@ if (empty($extName)) {
 echo "Element: {$extElement}, Type: {$extType}, Prefix: {$typePrefix}, Name: {$extName}\n";
 
 // ── Build release name ──────────────────────────────────────────────────────
-
-$releaseName = "{$extName} {$version} ({$typePrefix}{$extElement}-{$version})";
+// Use display-name from manifest.xml if available, otherwise fall back to extName
+$displayName = !empty($prettyName) ? $prettyName : $extName;
+$releaseName = "{$displayName} {$version} ({$typePrefix}{$extElement}-{$version})";
 echo "Release name: {$releaseName}\n";
 
 // ── Generate release notes ──────────────────────────────────────────────────

cli/release_publish.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/release_publish.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Publish a release and create copies for all lesser stability streams.
  *
  * When a release is published at a given stability, copies are created for all
@@ -45,6 +45,7 @@ $giteaUrl  = getenv('GITEA_URL') ?: 'https://git.mokoconsulting.tech';
 $org       = getenv('GITEA_ORG') ?: '';
 $repo      = getenv('GITEA_REPO') ?: '';
 $dryRun    = false;
+$repoUrl   = '';
 
 foreach ($argv as $i => $arg) {
     if ($arg === '--path'      && isset($argv[$i + 1])) $path      = $argv[$i + 1];
@@ -55,6 +56,7 @@ foreach ($argv as $i => $arg) {
     if ($arg === '--gitea-url' && isset($argv[$i + 1])) $giteaUrl  = $argv[$i + 1];
     if ($arg === '--org'       && isset($argv[$i + 1])) $org       = $argv[$i + 1];
     if ($arg === '--repo'      && isset($argv[$i + 1])) $repo      = $argv[$i + 1];
+    if ($arg === '--repo-url'  && isset($argv[$i + 1])) $repoUrl   = $argv[$i + 1];
     if ($arg === '--dry-run') $dryRun = true;
 }
 
@@ -64,21 +66,30 @@ if (empty($stability) || empty($token)) {
 }
 
 $cli = __DIR__;
-$php = PHP_BINARY;
+$php = '"' . PHP_BINARY . '"';
 $giteaUrl = rtrim($giteaUrl, '/');
 
+// Resolve path early for shell commands (Windows needs native paths)
+$resolvedPath = realpath($path) ?: $path;
+
 // Auto-detect org/repo from git remote if not set
 if (empty($org) || empty($repo)) {
-    $remote = trim((string) @shell_exec("cd " . escapeshellarg($path) . " && git remote get-url origin 2>/dev/null"));
+    $remote = trim((string) @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($resolvedPath) . " && git remote get-url origin 2>/dev/null"));
     if (preg_match('#/([^/]+)/([^/.]+?)(?:\.git)?$#', $remote, $m)) {
         if (empty($org))  $org  = $m[1];
         if (empty($repo)) $repo = $m[2];
     }
 }
 
+// Auto-construct repo URL for git auth if not provided
+if (empty($repoUrl) && !empty($token) && !empty($org) && !empty($repo)) {
+    $host = preg_replace('#^https?://#', '', $giteaUrl);
+    $repoUrl = "https://x-access-token:{$token}@{$host}/{$org}/{$repo}.git";
+}
+
 // Auto-detect branch
 if (empty($branch)) {
-    $branch = getenv('GITHUB_REF_NAME') ?: trim((string) @shell_exec("cd " . escapeshellarg($path) . " && git rev-parse --abbrev-ref HEAD 2>/dev/null"));
+    $branch = getenv('GITHUB_REF_NAME') ?: trim((string) @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($resolvedPath) . " && git rev-parse --abbrev-ref HEAD 2>/dev/null"));
 }
 
 $apiBase = "{$giteaUrl}/api/v1/repos/{$org}/{$repo}";
@@ -124,7 +135,8 @@ if ($bumpType !== 'none') {
 // -- Step 2: Read version and set stability suffix --
 echo "\n--- Step 2: Set version suffix ---\n";
 $versionOutput = [];
-exec("{$php} {$cli}/version_read.php --path " . escapeshellarg($path) . " 2>/dev/null", $versionOutput);
+$devNull = PHP_OS_FAMILY === 'Windows' ? '2>NUL' : '2>/dev/null';
+exec("{$php} {$cli}/version_read.php --path " . escapeshellarg($resolvedPath) . " {$devNull}", $versionOutput);
 $version = trim($versionOutput[0] ?? '');
 if (empty($version)) {
     fwrite(STDERR, "No version found\n");
@@ -144,6 +156,50 @@ if (!$dryRun) {
 $releaseVersion = $baseVersion . $suffixMap[$stability];
 echo "Release version: {$releaseVersion}\n";
 
+// -- Step 2b: Update badges and changelog --
+if (!$dryRun) {
+    passthru("{$php} {$cli}/badge_update.php --path " . escapeshellarg($path) . " --version " . escapeshellarg($baseVersion) . " 2>/dev/null");
+
+    $changelogFile = realpath($path) . '/CHANGELOG.md';
+    if (file_exists($changelogFile)) {
+        passthru("{$php} {$cli}/changelog_promote.php --path " . escapeshellarg($path) . " --version " . escapeshellarg($baseVersion) . " 2>/dev/null");
+        passthru("{$php} {$cli}/changelog_prune.php --path " . escapeshellarg($path) . " --keep 5 2>/dev/null");
+    }
+}
+
+// -- Step 2c: Commit version changes before building --
+$root = realpath($path) ?: $path;
+if (!$dryRun) {
+    // Configure git
+    @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git config --local user.email \"gitea-actions[bot]@mokoconsulting.tech\"");
+    @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git config --local user.name \"gitea-actions[bot]\"");
+    if (!empty($repoUrl)) {
+        @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git remote set-url origin " . escapeshellarg($repoUrl));
+    }
+
+    // Ensure we're on the actual branch (not detached HEAD from PR merge)
+    @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git fetch origin " . escapeshellarg($branch) . " 2>/dev/null");
+    @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git checkout -B " . escapeshellarg($branch) . " FETCH_HEAD 2>/dev/null");
+
+    // Re-apply version changes on the checked-out branch
+    passthru("{$php} {$cli}/version_set_platform.php --path " . escapeshellarg($path)
+        . " --version " . escapeshellarg($baseVersion)
+        . " --branch " . escapeshellarg($branch)
+        . " --stability " . escapeshellarg($stability) . " 2>/dev/null");
+    passthru("{$php} {$cli}/version_check.php --path " . escapeshellarg($path) . " --fix 2>/dev/null");
+    passthru("{$php} {$cli}/badge_update.php --path " . escapeshellarg($path) . " --version " . escapeshellarg($baseVersion) . " 2>/dev/null");
+
+    $diffCheck = trim((string) @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git diff --quiet && git diff --cached --quiet 2>&1 && echo clean || echo dirty"));
+    if ($diffCheck === 'dirty') {
+        @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git add -A");
+        @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git commit -m " . escapeshellarg("chore(release): build {$releaseVersion} [skip ci]")
+            . " --author=\"gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>\"");
+        $pushResult = @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git push origin " . escapeshellarg($branch) . " 2>&1");
+        echo "  Committed release changes\n";
+        echo "  Push: " . trim($pushResult ?? '') . "\n";
+    }
+}
+
 // -- Step 3: Build release package --
 echo "\n--- Step 3: Build and upload release ---\n";
 $releaseTag = $releaseTagMap[$stability];
@@ -261,12 +317,12 @@ echo "\n--- Step 6: Commit and sync updates.xml ---\n";
 $root = realpath($path) ?: $path;
 
 if (!$dryRun) {
-    $diffCheck = trim((string) @shell_exec("cd " . escapeshellarg($root) . " && git diff --quiet updates.xml 2>&1 && echo clean || echo dirty"));
+    $diffCheck = trim((string) @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git diff --quiet updates.xml 2>&1 && echo clean || echo dirty"));
     if ($diffCheck === 'dirty') {
-        @shell_exec("cd " . escapeshellarg($root) . " && git add updates.xml");
-        @shell_exec("cd " . escapeshellarg($root) . " && git commit -m " . escapeshellarg("chore: update channels for {$releaseVersion} [skip ci]")
+        @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git add updates.xml");
+        @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git commit -m " . escapeshellarg("chore: update channels for {$releaseVersion} [skip ci]")
             . " --author=\"gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>\"");
-        @shell_exec("cd " . escapeshellarg($root) . " && git push origin " . escapeshellarg($branch) . " 2>&1");
+        @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git push origin " . escapeshellarg($branch) . " 2>&1");
         echo "  Committed updates.xml\n";
     }
 

cli/scaffold_client.php

@@ -11,7 +11,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/scaffold_client.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Scaffold a new client-waas repo from Template-Client-WaaS with pre-configured settings
  */
 

cli/sync_rulesets.php

@@ -56,34 +56,38 @@ $PROTECTIONS = [
 		'name'   => 'MAIN — protect default branch',
 		'branch' => 'main',
 		'rules'  => [
-			'required_reviews'  => 1,
-			'dismiss_stale'     => true,
-			'enforce_admins'    => true,
-			'block_on_rejected' => true,
+			'required_reviews'       => 1,
+			'dismiss_stale'          => true,
+			'enforce_admins'         => true,
+			'block_on_rejected'      => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 	[
 		'name'   => 'VERSION — immutable snapshots',
 		'branch' => 'version/*',
 		'rules'  => [
-			'required_reviews' => 0,
-			'enforce_admins'   => true,
+			'required_reviews'       => 0,
+			'enforce_admins'         => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 	[
 		'name'   => 'DEV — prevent branch deletion',
 		'branch' => 'dev/*',
 		'rules'  => [
-			'required_reviews' => 0,
-			'enforce_admins'   => true,
+			'required_reviews'       => 0,
+			'enforce_admins'         => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 	[
 		'name'   => 'RC — prevent branch deletion',
 		'branch' => 'rc/*',
 		'rules'  => [
-			'required_reviews' => 0,
-			'enforce_admins'   => true,
+			'required_reviews'       => 0,
+			'enforce_admins'         => true,
+			'whitelist_actions_user' => true,
 		],
 	],
 ];

cli/updates_xml_build.php

@@ -100,6 +100,8 @@ if (file_exists($mokoManifest)) {
             };
         }
         $detectedName = (string)($mokoXml->identity->name ?? $repo);
+        // <display-name> is the human-friendly name for releases and updates.xml
+        $detectedDisplayName = (string)($mokoXml->identity->{"display-name"} ?? '');
         $detectedPackageType = (string)($mokoXml->build->{"package-type"} ?? '');
     }
 }
@@ -200,25 +202,7 @@ if ($manifest !== null) {
     $targetPlatform = "<targetplatform name=\"{$detectedPlatform}\" version=\".*\" />";
 }
 
-// Resolve language key names (e.g. PLG_SYSTEM_MOKOJOOMTOS)
-if (preg_match('/^[A-Z_]+$/', $extName)) {
-    $iniFiles = [];
-    $iterator = new RecursiveIteratorIterator(
-        new RecursiveDirectoryIterator($root, RecursiveDirectoryIterator::SKIP_DOTS)
-    );
-    foreach ($iterator as $file) {
-        if (preg_match('/\.sys\.ini$/i', $file->getFilename())) {
-            $iniFiles[] = $file->getPathname();
-        }
-    }
-    foreach ($iniFiles as $ini) {
-        $content = file_get_contents($ini);
-        if (preg_match('/^' . preg_quote($extName, '/') . '="([^"]+)"/m', $content, $m)) {
-            $extName = $m[1];
-            break;
-        }
-    }
-}
+// Display name resolution moved to manifest.xml <display-name> (below)
 
 // Fallbacks
 if (empty($extName)) {
@@ -228,27 +212,16 @@ if (empty($extType)) {
     $extType = 'component';
 }
 
-// If extName is still a technical/prefixed name (mod_foo, tpl_foo), prefer
-// the human-readable name from .mokogitea/manifest.xml <identity><name>
-if (preg_match('/^(pkg_|com_|mod_|plg_\w+_|tpl_|lib_)/i', $extName) && !empty($detectedName)) {
-    $extName = $detectedName;
+// Display name: use <display-name> from manifest.xml if available
+// This is the canonical human-friendly name — no type prefix added
+if (!empty($detectedDisplayName)) {
+    $displayName = $detectedDisplayName;
+} elseif (!empty($detectedName)) {
+    $displayName = $detectedName;
+} else {
+    $displayName = $extName;
 }
 
-// Build display name with type prefix (e.g. "Package - MokoWaaS")
-$typeDisplayMap = [
-    'package'   => 'Package',
-    'plugin'    => 'Plugin',
-    'module'    => 'Module',
-    'component' => 'Component',
-    'template'  => 'Template',
-    'library'   => 'Library',
-    'file'      => 'File',
-];
-$typeDisplay = $typeDisplayMap[$extType] ?? ucfirst($extType);
-// Strip existing type prefix to avoid doubling (e.g. "Template - Template - MokoOnyx")
-$extName = preg_replace('/^(' . implode('|', array_map('preg_quote', $typeDisplayMap)) . ')\s*-\s*/i', '', $extName);
-$displayName = "{$typeDisplay} - {$extName}";
-
 // -- Build type prefix --------------------------------------------------------
 $typePrefix = '';
 switch ($extType) {

cli/updates_xml_sync.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/updates_xml_sync.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Sync updates.xml to target branches via Gitea API
  * NOTE: Called by pre-release and auto-release workflows after updates.xml
  *       is modified on the current branch. Pushes the file to other branches

cli/version_auto_bump.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/version_auto_bump.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Auto patch-bump, set stability suffix, and commit — single CLI replacing inline workflow bash
  *
  * Usage:
@@ -63,7 +63,7 @@ if (array_key_exists($branch, $stabilityMap)) {
 }
 
 $cli = __DIR__;
-$php = PHP_BINARY;
+$php = '"' . PHP_BINARY . '"';
 
 // Auto-detect watch path from manifest.xml if not provided
 if (empty($watchPath)) {
@@ -81,7 +81,7 @@ $shouldBump = true;
 if (!empty($watchPath)) {
     $root = realpath($path) ?: $path;
     $diffOutput = trim((string) @shell_exec(
-        "cd " . escapeshellarg($root) . " && git diff --name-only HEAD~1 HEAD -- " . escapeshellarg($watchPath) . " 2>/dev/null"
+        (PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git diff --name-only HEAD~1 HEAD -- " . escapeshellarg($watchPath) . " 2>/dev/null"
     ));
     if (empty($diffOutput)) {
         echo "No changes in {$watchPath} — skipping version bump\n";
@@ -145,28 +145,28 @@ if ($dryRun) {
 $root = realpath($path) ?: $path;
 
 // Check if anything changed
-$diffStatus = trim((string) @shell_exec("cd " . escapeshellarg($root) . " && git diff --quiet && git diff --cached --quiet 2>&1 && echo clean || echo dirty"));
+$diffStatus = trim((string) @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git diff --quiet && git diff --cached --quiet 2>&1 && echo clean || echo dirty"));
 if ($diffStatus === 'clean') {
     echo "No version changes to commit\n";
     exit(0);
 }
 
 // Configure git
-@shell_exec("cd " . escapeshellarg($root) . " && git config --local user.email \"gitea-actions[bot]@mokoconsulting.tech\"");
-@shell_exec("cd " . escapeshellarg($root) . " && git config --local user.name \"gitea-actions[bot]\"");
+@shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git config --local user.email \"gitea-actions[bot]@mokoconsulting.tech\"");
+@shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git config --local user.name \"gitea-actions[bot]\"");
 
 if (!empty($repoUrl)) {
-    @shell_exec("cd " . escapeshellarg($root) . " && git remote set-url origin " . escapeshellarg($repoUrl));
+    @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git remote set-url origin " . escapeshellarg($repoUrl));
 }
 
-@shell_exec("cd " . escapeshellarg($root) . " && git add -A");
+@shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git add -A");
 $commitMsg = $shouldBump
     ? "chore(version): auto-bump patch {$displayVersion} [skip ci]"
     : "chore(version): set {$stability} suffix {$displayVersion} [skip ci]";
-@shell_exec("cd " . escapeshellarg($root) . " && git commit -m " . escapeshellarg($commitMsg)
+@shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git commit -m " . escapeshellarg($commitMsg)
     . " --author=\"gitea-actions[bot] <gitea-actions[bot]@mokoconsulting.tech>\"");
 
-$pushResult = @shell_exec("cd " . escapeshellarg($root) . " && git push origin " . escapeshellarg($branch) . " 2>&1");
+$pushResult = @shell_exec((PHP_OS_FAMILY === 'Windows' ? "cd /d " : "cd ") . escapeshellarg($root) . " && git push origin " . escapeshellarg($branch) . " 2>&1");
 echo $pushResult ?? '';
 
 echo "Bumped to {$displayVersion}\n";

cli/version_check.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/version_check.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Validate version consistency across README, manifests, and sub-packages
  *
  * Usage:

cli/wiki_sync.php

@@ -9,7 +9,7 @@
  * INGROUP: moko-platform
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /cli/wiki_sync.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Sync select wiki pages from moko-platform to all template repos
  */
 

deploy/backup-before-deploy.php

@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/backup-before-deploy.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Snapshot Joomla directories before deployment for rollback capability
  */
 

deploy/deploy-dolibarr.php

@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/deploy-dolibarr.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Deploy Dolibarr module files to a remote server via SFTP/rsync
  */
 

deploy/health-check.php

@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/health-check.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Post-deploy health check — verify a Joomla site is responding correctly
  */
 

deploy/rollback-joomla.php

@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/rollback-joomla.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Rollback a Joomla deployment by restoring from a pre-deploy snapshot
  */
 

deploy/sync-joomla.php

@@ -11,7 +11,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /deploy/sync-joomla.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Sync Joomla site directories between two servers via rsync over SSH
  */
 

lib/Enterprise/MokoGiteaAdapter.php

@@ -373,17 +373,20 @@ class MokoGiteaAdapter implements GitPlatformAdapter
     public function setBranchProtection(string $org, string $repo, string $branch, array $rules): array
     {
         // Gitea uses a flat branch protection API
+        $whitelistActions = $rules['whitelist_actions_user'] ?? false;
         $protection = [
-            'branch_name'                     => $branch,
-            'enable_push'                     => true,
-            'enable_push_whitelist'            => false,
-            'enable_merge_whitelist'           => false,
-            'enable_status_check'             => $rules['required_status_checks'] ?? false,
-            'enable_approvals_whitelist'       => false,
-            'required_approvals'              => $rules['required_reviews'] ?? 0,
-            'dismiss_stale_approvals'         => $rules['dismiss_stale'] ?? false,
-            'block_on_rejected_reviews'       => $rules['block_on_rejected'] ?? true,
-            'block_on_outdated_branch'        => $rules['block_on_outdated'] ?? false,
+            'branch_name'                       => $branch,
+            'enable_push'                       => true,
+            'enable_push_whitelist'              => $whitelistActions,
+            'push_whitelist_actions_user'        => $whitelistActions,
+            'enable_merge_whitelist'             => false,
+            'merge_whitelist_actions_user'       => $whitelistActions,
+            'enable_status_check'               => $rules['required_status_checks'] ?? false,
+            'enable_approvals_whitelist'         => false,
+            'required_approvals'                => $rules['required_reviews'] ?? 0,
+            'dismiss_stale_approvals'           => $rules['dismiss_stale'] ?? false,
+            'block_on_rejected_reviews'         => $rules['block_on_rejected'] ?? true,
+            'block_on_outdated_branch'          => $rules['block_on_outdated'] ?? false,
             'block_on_official_review_requests' => false,
         ];
 

tests/Unit/VersionBumpTest.php

@@ -63,7 +63,7 @@ class VersionBumpTest extends TestCase
     {
         file_put_contents(
             "{$this->tmpDir}/README.md",
-            "<!-- VERSION: 09.10.00 -->\nSome content\n"
+            "<!-- VERSION: 09.21.00 -->\nSome content\n"
         );
 
         $this->execute();

tests/Unit/VersionReadTest.php

@@ -34,7 +34,7 @@ class VersionReadTest extends TestCase
     {
         file_put_contents(
             "{$this->tmpDir}/README.md",
-            "# Test\n<!-- VERSION: 09.10.00 -->\n"
+            "# Test\n<!-- VERSION: 09.21.00 -->\n"
         );
 
         $this->assertSame('02.03.04', trim($this->runScript()));
@@ -68,7 +68,7 @@ class VersionReadTest extends TestCase
     {
         file_put_contents(
             "{$this->tmpDir}/README.md",
-            "<!-- VERSION: 09.10.00 -->\n"
+            "<!-- VERSION: 09.21.00 -->\n"
         );
         mkdir("{$this->tmpDir}/src", 0755, true);
         file_put_contents(

validate/check_file_integrity.php

@@ -12,7 +12,7 @@
  * INGROUP: MokoStandards
  * REPO: https://git.mokoconsulting.tech/MokoConsulting/moko-platform
  * PATH: /validate/check_file_integrity.php
- * VERSION: 09.10.00
+ * VERSION: 09.21.00
  * BRIEF: Compare deployed files on a remote server against the local repository to detect drift
  */